Fix denial of service - memory corruption.

[samba.git] / source3 / lib / readline.c

diff --git a/source3/lib/readline.c b/source3/lib/readline.c
index 254f55c86a14f8dce32e062994cb166970a7684f..70a82f27ab7b5abf325af0051de2480c5ddd9d23 100644 (file)
--- a/source3/lib/readline.c
+++ b/source3/lib/readline.c
@@ -45,6 +45,24 @@
 #  define RL_COMPLETION_CAST
 #endif /* HAVE_NEW_LIBREADLINE */
 
+static bool smb_rl_done;
+
+#if HAVE_LIBREADLINE
+/*
+ * MacOS/X does not have rl_done in readline.h, but
+ * readline.so has it
+ */
+extern int rl_done;
+#endif
+
+void smb_readline_done(void)
+{
+       smb_rl_done = true;
+#if HAVE_LIBREADLINE
+       rl_done = 1;
+#endif
+}
+
 /****************************************************************************
  Display the prompt and wait for input. Call callback() regularly
 ****************************************************************************/
@@ -69,10 +87,15 @@ static char *smb_readline_replacement(const char *prompt, void (*callback)(void)
                return NULL;
        }
 
-       while (1) {
+       while (!smb_rl_done) {
                timeout.tv_sec = 5;
                timeout.tv_usec = 0;
 
+               if (fd < 0 || fd >= FD_SETSIZE) {
+                       errno = EBADF;
+                       break;
+               }
+
                FD_ZERO(&fds);
                FD_SET(fd,&fds);
 
@@ -87,6 +110,8 @@ static char *smb_readline_replacement(const char *prompt, void (*callback)(void)
                        callback();
                }
        }
+       SAFE_FREE(line);
+       return NULL;
 }
 
 /****************************************************************************