Bugtraq: Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow

[Damien Miller <djm () mindrot org>]

David LeBlanc wrote:
>     if (__i == ((fd_set FAR *)(set))->fd_count) { \
>         if (((fd_set FAR *)(set))->fd_count < FD_SETSIZE) { \
>              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>             ((fd_set FAR *)(set))->fd_array[__i] = (fd); \
>             ((fd_set FAR *)(set))->fd_count++; \
>         } \
>     } \
> } while(0) 
>
> So if you attempted to put FD_SETSIZE + 1 sockets into an fd_set, it
> would just fail.
This effectively limits select to a maximum of FD_SETSIZE descriptors on
Windows. I don't think that this limitiation exists on other platforms.

Correctly written programs dynamically allocate their FD_SETs to avoid
these problems (or they use poll or some other mechanism instead).

-d