Check new fds are not within Valgrind's reserved range. Still one case for

recvmsg() where I'm not sure if it should be checked, and if so, what error
should be returned if the check fails.

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@2268

diff --git a/coregrind/vg_syscalls.c b/coregrind/vg_syscalls.c
index 05ba314020e5615f098b15cc81d198fca24b42f4..d3d6aa936f2c7cbbe317b11e87d0eb9b9e730752 100644 (file)
--- a/coregrind/vg_syscalls.c
+++ b/coregrind/vg_syscalls.c
@@ -857,6 +857,8 @@ void check_cmsg_for_fds(Int tid, struct msghdr *msg)
 
          for (i = 0; i < fdc; i++)
             if(VG_(clo_track_fds))
+               // XXX: must we check the range on these fds with
+               //      fd_allowed()?
                record_fd_open (tid, fds[i], VG_(resolve_filename)(fds[i]));
       }
 
@@ -2145,9 +2147,15 @@ PRE(fcntl)
 
 POST(fcntl)
 {
-   if (arg2 == VKI_F_DUPFD)
-      if (VG_(clo_track_fds))
-         record_fd_open(tid, res, VG_(resolve_filename)(res));
+   if (arg2 == VKI_F_DUPFD) {
+      if (!fd_allowed(res, "fcntl(DUPFD)", tid)) {
+         VG_(close)(res);
+         res = -VKI_EMFILE;
+      } else {
+         if (VG_(clo_track_fds))
+            record_fd_open(tid, res, VG_(resolve_filename)(res));
+      }
+   }
 }
 
 PRE(fchdir)
@@ -2178,9 +2186,15 @@ PRE(fcntl64)
 
 POST(fcntl64)
 {
-   if (arg2 == VKI_F_DUPFD)
-      if(VG_(clo_track_fds))
-         record_fd_open(tid, res, VG_(resolve_filename)(res));
+   if (arg2 == VKI_F_DUPFD) {
+      if (!fd_allowed(res, "fcntl64(DUPFD)", tid)) {
+         VG_(close)(res);
+         res = -VKI_EMFILE;
+      } else {
+         if (VG_(clo_track_fds))
+            record_fd_open(tid, res, VG_(resolve_filename)(res));
+      }
+   }
 }
 
 PRE(fstat)
@@ -3878,7 +3892,7 @@ POST(open)
       VG_(close)(res);
       res = -VKI_EMFILE;
    } else {
-      if(VG_(clo_track_fds))
+      if (VG_(clo_track_fds))
          record_fd_open(tid, res, VG_(arena_strdup)(VG_AR_CORE, (Char*)arg1));
    }
    MAYBE_PRINTF("%d\n",res);
@@ -3922,7 +3936,7 @@ POST(creat)
       VG_(close)(res);
       res = -VKI_EMFILE;
    } else {
-      if(VG_(clo_track_fds))
+      if (VG_(clo_track_fds))
          record_fd_open(tid, res, VG_(arena_strdup)(VG_AR_CORE, (Char*)arg1));
    }
    MAYBE_PRINTF("%d\n",res);
@@ -3947,7 +3961,7 @@ POST(pipe)
       res = -VKI_EMFILE;
    } else {
       VG_TRACK( post_mem_write, arg1, 2*sizeof(int) );
-      if(VG_(clo_track_fds)) {
+      if (VG_(clo_track_fds)) {
          record_fd_open(tid, p[0], NULL);
          record_fd_open(tid, p[1], NULL);
       }
@@ -4496,21 +4510,31 @@ POST(socketcall)
 
    switch (arg1 /* request */) {
 
-   case SYS_SOCKETPAIR:
-      /* XXX TODO: check return fd against VG_(max_fd) */
+   case SYS_SOCKETPAIR: {
+      Int fd1 = ((UInt*)((UInt*)arg2)[3])[0];
+      Int fd2 = ((UInt*)((UInt*)arg2)[3])[1];
       VG_TRACK( post_mem_write, ((UInt*)arg2)[3], 2*sizeof(int) );
-      if(VG_(clo_track_fds)) {
-         record_fd_open(tid, ((UInt*)((UInt*)arg2)[3])[0], NULL);
-         record_fd_open(tid, ((UInt*)((UInt*)arg2)[3])[1], NULL);
+      if (!fd_allowed(fd1, "socketcall.socketpair", tid) ||
+          !fd_allowed(fd2, "socketcall.socketpair", tid)) {
+         VG_(close)(fd1);
+         VG_(close)(fd2);
+         res = -VKI_EMFILE;
+      } else {
+         VG_TRACK( post_mem_write, ((UInt*)arg2)[3], 2*sizeof(int) );
+         if (VG_(clo_track_fds)) {
+            record_fd_open(tid, fd1, NULL);
+            record_fd_open(tid, fd2, NULL);
+         }
       }
       break;
+   }
 
    case SYS_SOCKET:
       if (!fd_allowed(res, "socket", tid)) {
         VG_(close)(res);
         res = -VKI_EMFILE;
       } else {
-         if(VG_(clo_track_fds))
+         if (VG_(clo_track_fds))
             record_fd_open(tid, res, NULL);
       }
       break;
@@ -4536,7 +4560,7 @@ POST(socketcall)
         if (addr_p != (Addr)NULL) 
            buf_and_len_post_check ( tid, res, addr_p, addrlen_p,
                                     "socketcall.accept(addrlen_out)" );
-         if(VG_(clo_track_fds))
+         if (VG_(clo_track_fds))
             record_fd_open(tid, res, NULL);
       }
       break;
@@ -4932,8 +4956,15 @@ POST(futex)
 {
    if (!VG_(is_kerror)(res)) {
       VG_TRACK( post_mem_write, arg1, sizeof(int) );
-      if (arg2 == VKI_FUTEX_FD && VG_(clo_track_fds))
-         record_fd_open(tid, res, NULL);
+      if (arg2 == VKI_FUTEX_FD) {
+         if (!fd_allowed(res, "futex", tid)) {
+            VG_(close)(res);
+            res = -VKI_ENFILE;
+         } else {
+            if (VG_(clo_track_fds))
+               record_fd_open(tid, res, VG_(arena_strdup)(VG_AR_CORE, (Char*)arg1));
+         }
+      }
    }
 }
 

diff --git a/include/vg_kerneliface.h b/include/vg_kerneliface.h
index 54730080b3a27a492cad79c9d8972ed532e2f4c0..2cd7c0f16d86267484f58d25a86554e87dc901fe 100644 (file)
--- a/include/vg_kerneliface.h
+++ b/include/vg_kerneliface.h
@@ -374,6 +374,7 @@ struct vki_ucontext {
 #define        VKI_EFAULT          14      /* Bad address */
 #define VKI_EEXIST         17      /* File exists */
 #define VKI_EINVAL          22      /* Invalid argument */
+#define VKI_ENFILE          23      /* File table overflow */
 #define VKI_EMFILE         24      /* Too many open files */
 #define VKI_ENOSYS          38      /* Function not implemented */