<<< Date Index >>>     <<< Thread Index >>>

Re: SECURITY.NNOV: Multiple applications fd_set structure bitmap array index overflow

David LeBlanc wrote:

    if (__i == ((fd_set FAR *)(set))->fd_count) { \
        if (((fd_set FAR *)(set))->fd_count < FD_SETSIZE) { \
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            ((fd_set FAR *)(set))->fd_array[__i] = (fd); \
            ((fd_set FAR *)(set))->fd_count++; \
        } \
    } \
} while(0) 
So if you attempted to put FD_SETSIZE + 1 sockets into an fd_set, it
would just fail.


This effectively limits select to a maximum of FD_SETSIZE descriptors on
Windows. I don't think that this limitiation exists on other platforms.

Correctly written programs dynamically allocate their FD_SETs to avoid
these problems (or they use poll or some other mechanism instead).

-d