Fix denial of service - memory corruption.

[samba.git] / source3 / client / dnsbrowse.c

diff --git a/source3/client/dnsbrowse.c b/source3/client/dnsbrowse.c
index 5e3a4de9cff03afb16397a8a6ee03d0579d87326..a6b9360a1b0a257e8ecf83f7721c78f29cbfc012 100644 (file)
--- a/source3/client/dnsbrowse.c
+++ b/source3/client/dnsbrowse.c
@@ -81,6 +81,11 @@ static void do_smb_resolve(struct mdns_smbsrv_result *browsesrv)
                        TALLOC_FREE(fdset);
                }
 
+               if (mdnsfd < 0 || mdnsfd >= FD_SETSIZE) {
+                       errno = EBADF;
+                       break;
+               }
+
                fdsetsz = howmany(mdnsfd + 1, NFDBITS) * sizeof(fd_mask);
                fdset = TALLOC_ZERO(ctx, fdsetsz);
                FD_SET(mdnsfd, fdset);
@@ -181,6 +186,12 @@ int do_smb_browse(void)
                        TALLOC_FREE(fdset);
                }
 
+               if (mdnsfd < 0 || mdnsfd >= FD_SETSIZE) {
+                       errno = EBADF;
+                       TALLOC_FREE(ctx);
+                       return 1;
+               }
+
                fdsetsz = howmany(mdnsfd + 1, NFDBITS) * sizeof(fd_mask);
                fdset = TALLOC_ZERO(ctx, fdsetsz);
                FD_SET(mdnsfd, fdset);