Problem - Kevin Tafuro

3.13 Preventing File Descriptor Overflows When
Using select( )
Problem
Your program uses the select( ) system call to determine when sockets are ready for
writing, have data waiting to be read, or have an exceptional condition (e.g., out-ofband
data has arrived). Using select( ) requires the use of the fd_set data type,
which typically entails the use of the FD_*( ) family of macros. In most implementations,
FD_SET( ) and FD_CLR( ), in particular, are susceptible to an array overrun.
Solution
Do not use the FD_*( ) family of macros. Instead, use the macros that are provided in
this recipe. The FD_SET( ) and FD_CLR( ) macros will modify an fd_set object without
performing any bounds checking. The macros we provide will do proper bounds
checking.
Discussion
The select( ) system call is normally used to multiplex sockets. In a single-threaded
environment, select( ) allows you to build sets of socket descriptors for which you
wish to wait for data to become available or that you wish to have available to write
data to. The fd_set data type is used to hold a list of the socket descriptors, and several
standard macros are used to manipulate objects of this type.
Normally, fd_set is defined as a structure with a single member that is a statically
allocated array of long integers. Because socket descriptors are always numbered
starting with 0 and ending with the highest allowable descriptor, the array of integers
in an fd_set is actually treated as a bitmask with a one-to-one correspondence
between bits and socket descriptors.
The size of the array in the fd_set structure is determined by the FD_SETSIZE macro.
Most often, the size of the array is sufficiently large to be able to handle any possible
file descriptor, but the problem is that most implementations of the FD_SET( ) and
FD_CLR( ) macros (which are used to set and clear socket descriptors in an fd_set
object) do not perform any bounds checking and will happily overrun the array if
asked to do so.
If FD_SETSIZE is defined to be sufficiently large, why is this a problem? Consider the
situation in which a server program is compiled with FD_SETSIZE defined to be 256,
which is normally the maximum number of file and socket descriptors allowed in a
Unix process. Everything works just fine for a while, but eventually the number of
allowed file descriptors is increased to 512 because 256 are no longer enough for all
112 | Chapter 3: Input Validation
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.