libmicrohttpd

commit 3118c44d9c7624b3cf7f87c57d056169f6511e3b
parent ebbf25eb5bb006cd58ad5dd76d490eb2d0db7d76
Author: Evgeny Grin (Karlson2k) <k2k@narod.ru>
Date:   Mon,  3 Oct 2016 21:13:35 +0000

Fix out-of-buffer addressing when 'mhd.socket' is '-1'

Diffstat:
M
src/microhttpd/daemon.c
 | 
19
+++++++++++--------

1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/src/microhttpd/daemon.c b/src/microhttpd/daemon.c
@@ -715,17 +715,20 @@ urh_from_fdset (struct MHD_UpgradeResponseHandle *urh,
                 const fd_set *rs,
                 const fd_set *ws)
 {
-  if (FD_ISSET (urh->connection->socket_fd,
-                rs))
+  const MHD_socket mhd_sckt = urh->mhd.socket;
+  const MHD_socket conn_sckt = urh->connection->socket_fd;
+
+  if ((MHD_INVALID_SOCKET != conn_sckt) &&
+      FD_ISSET (conn_sckt, rs))
     urh->app.celi |= MHD_EPOLL_STATE_READ_READY;
-  if (FD_ISSET (urh->connection->socket_fd,
-                ws))
+  if ((MHD_INVALID_SOCKET != conn_sckt) &&
+      FD_ISSET (conn_sckt, ws))
     urh->app.celi |= MHD_EPOLL_STATE_WRITE_READY;
-  if (FD_ISSET (urh->mhd.socket,
-                rs))
+  if ((MHD_INVALID_SOCKET != mhd_sckt) &&
+      FD_ISSET (mhd_sckt, rs))
     urh->mhd.celi |= MHD_EPOLL_STATE_READ_READY;
-  if (FD_ISSET (urh->mhd.socket,
-                ws))
+  if ((MHD_INVALID_SOCKET != mhd_sckt) &&
+      FD_ISSET (mhd_sckt, ws))
     urh->mhd.celi |= MHD_EPOLL_STATE_WRITE_READY;
 }
 #endif