RE: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow
-----Original Message-----
3APA3A [mailto:3APA3A@xxxxxxxxxxxxxxxx] wrote:
> For Windows fd_set is a sockets array, not bitmask and FD_SETSIZE
defines maximum number of sockets in this array. So, Windows
application may be vulnerable only if it places a large number of
sockets into same fd_set structure (finite state machine architecture).
[snip]
> For Windows default FD_SETSIZE is 64 and select() is only
POSIX-complatible function to wait on socket input (there is no poll(),
but there are Windows specific functions).
[snip]
If you look at Winsock[2].h, you find this:
#ifndef FD_SETSIZE
#define FD_SETSIZE 64
#endif /* FD_SETSIZE */
typedef struct fd_set {
u_int fd_count; /* how many are SET? */
SOCKET fd_array[FD_SETSIZE]; /* an array of SOCKETs */
} fd_set;
#define FD_SET(fd, set) do { \
u_int __i; \
for (__i = 0; __i < ((fd_set FAR *)(set))->fd_count; __i++) { \
if (((fd_set FAR *)(set))->fd_array[__i] == (fd)) { \
break; \
} \
} \
if (__i == ((fd_set FAR *)(set))->fd_count) { \
if (((fd_set FAR *)(set))->fd_count < FD_SETSIZE) { \
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
((fd_set FAR *)(set))->fd_array[__i] = (fd); \
((fd_set FAR *)(set))->fd_count++; \
} \
} \
} while(0)
So if you attempted to put FD_SETSIZE + 1 sockets into an fd_set, it
would just fail.
Additionally, if you want to write a high-performance asynchronous
sockets application on Windows, I highly recommend either using
WSAEventSelect or I/O completion ports. If you are dealing with a
cross-platform application, I would abstract out the platform-specific
code - the perf gains are worth it. I've done this, and the improvements
were significant.
Hope this helps -