diff options
| author | netchild <netchild@FreeBSD.org> | 2003-06-09 16:45:37 +0000 |
|---|---|---|
| committer | netchild <netchild@FreeBSD.org> | 2003-06-09 16:45:37 +0000 |
| commit | 4521ab44c2a848e7a0b456d465cabf4e47088a00 (patch) | |
| tree | 616626eadaaf8de8ccdac2724d76e6090b4a00e2 /lib/libc_r | |
| parent | 1a01f6bc0cd856ff9a03f2bfa3a9dcdaf9d45dd6 (diff) | |
| download | FreeBSD-src-4521ab44c2a848e7a0b456d465cabf4e47088a00.zip FreeBSD-src-4521ab44c2a848e7a0b456d465cabf4e47088a00.tar.gz | |
Sanity check fd before using it as an array index.
Noticed by: ted@NLnetLabs.nl (Ted Lindgreen)
Approved by: ru
Diffstat (limited to 'lib/libc_r')
| -rw-r--r-- | lib/libc_r/uthread/uthread_close.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libc_r/uthread/uthread_close.c b/lib/libc_r/uthread/uthread_close.c index 0847fcd..ba291a3 100644 --- a/lib/libc_r/uthread/uthread_close.c +++ b/lib/libc_r/uthread/uthread_close.c @@ -49,7 +49,8 @@ _close(int fd) struct stat sb; struct fd_table_entry *entry; - if ((fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) || + if ((fd < 0) || (fd >= _thread_dtablesize) || + (fd == _thread_kern_pipe[0]) || (fd == _thread_kern_pipe[1]) || (_thread_fd_table[fd] == NULL)) { /* * Don't allow silly programs to close the kernel pipe |
