Fix denial of service - memory corruption.

[samba.git] / nsswitch / wb_common.c

diff --git a/nsswitch/wb_common.c b/nsswitch/wb_common.c
index d0dfcb8bbfb67326d82f2736b8110b3a9baf8688..75ce585a86349e7c4f19207ae7ec100ac0a2430b 100644 (file)
--- a/nsswitch/wb_common.c
+++ b/nsswitch/wb_common.c
@@ -240,6 +240,12 @@ static int winbind_named_pipe_sock(const char *dir)
 
                switch (errno) {
                        case EINPROGRESS:
+
+                               if (fd < 0 || fd >= FD_SETSIZE) {
+                                       errno = EBADF;
+                                       goto error_out;
+                               }
+
                                FD_ZERO(&w_fds);
                                FD_SET(fd, &w_fds);
                                tv.tv_sec = CONNECT_TIMEOUT - wait_time;
@@ -384,6 +390,12 @@ int winbind_write_sock(void *buffer, int count, int recursing, int need_priv)
                struct timeval tv;
                fd_set r_fds;
 
+               if (winbindd_fd < 0 || winbindd_fd >= FD_SETSIZE) {
+                       errno = EBADF;
+                       winbind_close_sock();
+                       return -1;
+               }
+
                /* Catch pipe close on other end by checking if a read()
                   call would not block by calling select(). */
 
@@ -444,6 +456,11 @@ int winbind_read_sock(void *buffer, int count)
                struct timeval tv;
                fd_set r_fds;
 
+               if (winbindd_fd < 0 || winbindd_fd >= FD_SETSIZE) {
+                       errno = EBADF;
+                       winbind_close_sock();
+                       return -1;
+               }
                /* Catch pipe close on other end by checking if a read()
                   call would not block by calling select(). */