diff options
author | Peter Maydell <peter.maydell@linaro.org> | 2018-11-06 15:13:20 +0000 |
---|---|---|
committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2018-11-10 15:07:53 +0100 |
commit | a095b4649f6eb1f5b7b9c1a9a26adc13601f3377 (patch) | |
tree | 275adf9bd4e6cc16e38b9b97800f23da6d0a972c | |
parent | b6477f7746aadea908e1007c82bac7de44905bd6 (diff) | |
download | slirp-a095b4649f6eb1f5b7b9c1a9a26adc13601f3377.zip slirp-a095b4649f6eb1f5b7b9c1a9a26adc13601f3377.tar.gz slirp-a095b4649f6eb1f5b7b9c1a9a26adc13601f3377.tar.bz2 |
slirp: Don't pass possibly -1 fd to send()
Coverity complains (CID 1005726) that we might pass -1 as the fd
argument to send() in slirp_send(), because we previously checked for
"so->s == -1 && so->extra". The case of "so->s == -1 but so->extra
NULL" should not in theory happen, but it is hard to guarantee
because various places in the code do so->s = qemu_socket(...) and so
will end up with so->s == -1 on failure, and not all the paths which
call that always throw away the socket in that case (eg
tcp_fconnect()). So just check specifically for the condition and
fail slirp_send().
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-rw-r--r-- | slirp.c | 11 |
1 files changed, 11 insertions, 0 deletions
@@ -1084,6 +1084,17 @@ ssize_t slirp_send(struct socket *so, const void *buf, size_t len, int flags) return len; } + if (so->s == -1) { + /* + * This should in theory not happen but it is hard to be + * sure because some code paths will end up with so->s == -1 + * on a failure but don't dispose of the struct socket. + * Check specifically, so we don't pass -1 to send(). + */ + errno = EBADF; + return -1; + } + return send(so->s, buf, len, flags); } |