Fix possible memory overwrite in init_from_environment().

It was possible for a user to overwrite memory at a relative location
with 1 by passing a negative file descriptor.
This commit is contained in:
Simon Ruderich
2013-06-13 22:08:08 +02:00
parent f30dbbd26d
commit 59375c2b79
6 changed files with 84 additions and 9 deletions

View File

@@ -135,7 +135,10 @@ static void init_from_environment(void) {
*x = 0;
int fd = atoi(last);
if (fd < TRACKFDS_STATIC_COUNT) {
if (fd < 0) {
goto next;
} else if (fd < TRACKFDS_STATIC_COUNT) {
tracked_fds[fd] = 1;
} else {
if (!tracked_fds_list) {