connection: fix buffer-overflow in close_fds()
authorDavid Herrmann <dh.herrmann@googlemail.com>
Thu, 11 Oct 2012 21:37:46 +0000 (23:37 +0200)
committerKristian Høgsberg <krh@bitplanet.net>
Mon, 15 Oct 2012 20:15:41 +0000 (16:15 -0400)
commit9bd41ed6a9f027d687e449ed020db848b28bb58a
tree39dec69cd022fad853da847c45bfa0d66aec119d
parentcda89f3a42789771907a9d6a3159f7c22c99985e
connection: fix buffer-overflow in close_fds()

If we push two messages via wl_connection_write() and both messages
contain more than MAX_FDS_OUT file-descriptors combined, then
wl_connection_flush() will write only MAX_FDS_OUT of them, but close all
pending ones, too.

Furthermore, close_fds() will copy more FDs out of the buffer than it can
hold and cause a buffer overflow. Therefore, we simply pass a maximum
limit to close_fds().

During shutdown, we simply close all available FDs.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
src/connection.c