Re: [Emacs-diffs] master a066fb1: Fix use-after-close in connect_network_socket

Re: [Emacs-diffs] master a066fb1: Fix use-after-close in connect_network_socket

[Ken Brown]

On 7/21/2016 5:29 AM, Paul Eggert wrote:
> branch: master
> commit a066fb1ceee373c982214c28206108c5fba01bf7
> Author: Paul Eggert <eggert@cs.ucla.edu>
> Commit: Paul Eggert <eggert@cs.ucla.edu>
>
>     Fix use-after-close in connect_network_socket
>
>     * src/process.c (connect_network_socket): Don’t use
>     external_sock_fd after closing it.  Problem found by Coverity Scan.
> ---
>  src/process.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/src/process.c b/src/process.c
> index bdbdefa..bc2ac45 100644
> --- a/src/process.c
> +++ b/src/process.c
> @@ -3185,6 +3185,8 @@ connect_network_socket (Lisp_Object proc, Lisp_Object addrinfos,
>  	      xerrno = errno;
>  	      emacs_close (s);
>  	      s = -1;
> +	      if (socket_to_use < 0)
> +		break;
>  	      continue;
>  	    }
>  	}
> @@ -3312,6 +3314,8 @@ connect_network_socket (Lisp_Object proc, Lisp_Object addrinfos,
>        specpdl_ptr = specpdl + count1;
>        emacs_close (s);
>        s = -1;
> +      if (socket_to_use < 0)
> +	break;
>
>  #ifdef WINDOWSNT
>        if (xerrno == EINTR)

This commit causes two network-streams-tests failures on Cygwin:

    FAILED  echo-server-with-dns
    FAILED  echo-server-with-localhost

Did you perhaps get the condition (socket_to_use < 0) backwards?  If 
socket_to_use < 0, then it is not external_sock_fd that has been closed.

Ken

Re: [Emacs-diffs] master a066fb1: Fix use-after-close in connect_network_socket

[Paul Eggert]

[-- Attachment #1: Type: text/plain, Size: 247 bytes --]

Ken Brown wrote:
> Did you perhaps get the condition (socket_to_use < 0) backwards?  If
> socket_to_use < 0, then it is not external_sock_fd that has been closed.

Yes, thanks, I think you're right. I installed the attached on master to fix that.

[-- Attachment #2: 0001-Fix-use-after-close-in-connect_network_socket.patch --]
[-- Type: text/x-diff, Size: 1095 bytes --]

From 10ae6903134d0c501ede683e698a4f0a36cd6297 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 2 Aug 2016 03:31:04 -0400
Subject: [PATCH] Fix use-after-close in connect_network_socket

* src/process.c (connect_network_socket):
Reverse sense of previous fix.  Problem reported by Ken Brown in:
http://lists.gnu.org/archive/html/emacs-devel/2016-08/msg00004.html
---
 src/process.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/process.c b/src/process.c
index bc2ac45..5e48e43 100644
--- a/src/process.c
+++ b/src/process.c
@@ -3185,7 +3185,7 @@ connect_network_socket (Lisp_Object proc, Lisp_Object addrinfos,
 	      xerrno = errno;
 	      emacs_close (s);
 	      s = -1;
-	      if (socket_to_use < 0)
+	      if (0 <= socket_to_use)
 		break;
 	      continue;
 	    }
@@ -3314,7 +3314,7 @@ connect_network_socket (Lisp_Object proc, Lisp_Object addrinfos,
       specpdl_ptr = specpdl + count1;
       emacs_close (s);
       s = -1;
-      if (socket_to_use < 0)
+      if (0 <= socket_to_use)
 	break;
 
 #ifdef WINDOWSNT
-- 
2.5.5