From 6cf9117bfd3f3b19cd6cfcf32910e29e57a4b1f7 Mon Sep 17 00:00:00 2001 From: Bastien Nocera Date: Thu, 30 May 2024 16:57:59 +0200 Subject: [PATCH] shared/mainloop: Fix integer overflow signalfd_siginfo uses a u32 for the signal number, but siginfo_t uses a signed integer for it, so an (unlikely) big value for the signal number could result in a negative value being passed to the callbacks. Catch that and bail early. Error: INTEGER_OVERFLOW (CWE-190): [#def44] [important] src/shared/mainloop-notify.c:137:3: underflow: The cast of "si.ssi_signo" to a signed type could result in a negative number. 135| 136| if (data && data->func) 137|-> data->func(si.ssi_signo, data->user_data); 138| 139| return true; --- src/shared/mainloop-notify.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/shared/mainloop-notify.c b/src/shared/mainloop-notify.c index 33be3cf8d..11989512e 100644 --- a/src/shared/mainloop-notify.c +++ b/src/shared/mainloop-notify.c @@ -15,6 +15,7 @@ #define _GNU_SOURCE #include #include +#include #include #include #include @@ -130,7 +131,7 @@ static bool signal_read(struct io *io, void *user_data) fd = io_get_fd(io); result = read(fd, &si, sizeof(si)); - if (result != sizeof(si)) + if (result != sizeof(si) || si.ssi_signo > INT_MAX) return false; if (data && data->func) -- 2.47.3