Author: cem
Date: Wed May 11 18:03:51 2016
New Revision: 299476
URL: https://svnweb.freebsd.org/changeset/base/299476

Log:
  whois(1): Fix potential double-close and logic mistakes
  
  Close the fd the poll error was detected on, rather than the last opened fd, 
to
  fix the double-close.
  
  Use -1 to make it explict which int variables no longer own socket file
  descriptors.
  
  Actually shrink, rather than grow, the poll timeout to match comment.
  
  Reported by:  Coverity
  CID:          1304860, 1305616
  Sponsored by: EMC / Isilon Storage Division

Modified:
  head/usr.bin/whois/whois.c

Modified: head/usr.bin/whois/whois.c
==============================================================================
--- head/usr.bin/whois/whois.c  Wed May 11 17:57:26 2016        (r299475)
+++ head/usr.bin/whois/whois.c  Wed May 11 18:03:51 2016        (r299476)
@@ -316,6 +316,11 @@ connect_to_any_host(struct addrinfo *hos
                                fds[i].fd = s;
                                fds[i].events = POLLERR | POLLHUP |
                                                POLLIN | POLLOUT;
+                               /*
+                                * From here until a socket connects, the
+                                * socket fd is owned by the fds[] poll array.
+                                */
+                               s = -1;
                                count++;
                                i++;
                        } else {
@@ -357,7 +362,7 @@ connect_to_any_host(struct addrinfo *hos
                                 * after a new host have been added.
                                 */
                                if (timeout >= 3)
-                                       timeout <<= 1;
+                                       timeout >>= 1;
 
                                break;
                        } else if (n < 0) {
@@ -377,7 +382,7 @@ connect_to_any_host(struct addrinfo *hos
                                    fds[j].revents == 0)
                                        continue;
                                if (fds[j].revents & ~(POLLIN | POLLOUT)) {
-                                       close(s);
+                                       close(fds[j].fd);
                                        fds[j].fd = -1;
                                        fds[j].events = 0;
                                        count--;
@@ -385,6 +390,7 @@ connect_to_any_host(struct addrinfo *hos
                                } else if (fds[j].revents & (POLLIN | POLLOUT)) 
{
                                        /* Connect succeeded. */
                                        s = fds[j].fd;
+                                       fds[j].fd = -1;
 
                                        goto done;
                                }
@@ -401,7 +407,7 @@ connect_to_any_host(struct addrinfo *hos
 done:
        /* Close all watched fds except the succeeded one */
        for (j = 0; j < i; j++)
-               if (fds[j].fd != s && fds[j].fd != -1)
+               if (fds[j].fd != -1)
                        close(fds[j].fd);
        free(fds);
        return (s);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to