diff options
| author | Jesus Cea <jcea@jcea.es> | 2011-09-21 01:47:39 (GMT) |
|---|---|---|
| committer | Jesus Cea <jcea@jcea.es> | 2011-09-21 01:47:39 (GMT) |
| commit | c23484b21f8b62ec7c62a6e2253cf5f656e2ef06 (patch) | |
| tree | 6ae29d5fec5ac44b18f218c9de2da19ad4b2d24d /Modules/_multiprocessing | |
| parent | 4ac5d2cda495b90c7990f9e231553fa2dca9854f (diff) | |
| download | cpython-c23484b21f8b62ec7c62a6e2253cf5f656e2ef06.zip cpython-c23484b21f8b62ec7c62a6e2253cf5f656e2ef06.tar.gz cpython-c23484b21f8b62ec7c62a6e2253cf5f656e2ef06.tar.bz2 | |
Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was actually received
Diffstat (limited to 'Modules/_multiprocessing')
| -rw-r--r-- | Modules/_multiprocessing/multiprocessing.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Modules/_multiprocessing/multiprocessing.c b/Modules/_multiprocessing/multiprocessing.c index 7582664..31a8da8 100644 --- a/Modules/_multiprocessing/multiprocessing.c +++ b/Modules/_multiprocessing/multiprocessing.c @@ -177,6 +177,17 @@ multiprocessing_recvfd(PyObject *self, PyObject *args) if (res < 0) return PyErr_SetFromErrno(PyExc_OSError); + if (msg.msg_controllen < CMSG_LEN(sizeof(int)) || + (cmsg = CMSG_FIRSTHDR(&msg)) == NULL || + cmsg->cmsg_level != SOL_SOCKET || + cmsg->cmsg_type != SCM_RIGHTS || + cmsg->cmsg_len < CMSG_LEN(sizeof(int))) { + /* If at least one control message is present, there should be + no room for any further data in the buffer. */ + PyErr_SetString(PyExc_RuntimeError, "No file descriptor received"); + return NULL; + } + fd = * (int *) CMSG_DATA(cmsg); return Py_BuildValue("i", fd); } |