Don't realloc connection handling array.

That leads to undefined behaviour due to a race condition.

diff --git a/etc/afpd/main.c b/etc/afpd/main.c
index 2606f800c4267cc3fcd1a4486e08d21c807e9869..f9b56ed65ba690bc30d979f5e7a2c74fa169abfd 100644 (file)
--- a/etc/afpd/main.c
+++ b/etc/afpd/main.c
@@ -51,6 +51,9 @@ static int argc = 0;
 static char **argv = NULL;
 #endif /* TRU64 */
 
+#define AFP_LISTENERS 32
+#define FDSET_SAFETY  5
+
 unsigned char  nologin = 0;
 struct afp_options default_options;
 static AFPConfig *configs;
@@ -92,11 +95,25 @@ static void fd_set_listening_sockets(void)
     for (config = configs; config; config = config->next) {
         if (config->fd < 0) /* for proxies */
             continue;
-        fdset_add_fd(&fdset, &polldata, &fdset_used, &fdset_size, config->fd, LISTEN_FD, config);
+        fdset_add_fd(default_options.connections + AFP_LISTENERS + FDSET_SAFETY,
+                     &fdset,
+                     &polldata,
+                     &fdset_used,
+                     &fdset_size,
+                     config->fd,
+                     LISTEN_FD,
+                     config);
     }
 
     if (default_options.flags & OPTION_KEEPSESSIONS)
-        fdset_add_fd(&fdset, &polldata, &fdset_used, &fdset_size, disasociated_ipc_fd, DISASOCIATED_IPC_FD, NULL);
+        fdset_add_fd(default_options.connections + AFP_LISTENERS + FDSET_SAFETY,
+                     &fdset,
+                     &polldata,
+                     &fdset_used,
+                     &fdset_size,
+                     disasociated_ipc_fd,
+                     DISASOCIATED_IPC_FD,
+                     NULL);
 }
  
 static void fd_reset_listening_sockets(void)
@@ -459,7 +476,14 @@ int main(int ac, char **av)
                     /* config->server_start is afp_config.c:dsi_start() for DSI */
                     if (child = config->server_start(config, configs, server_children)) {
                         /* Add IPC fd to select fd set */
-                        fdset_add_fd(&fdset, &polldata, &fdset_used, &fdset_size, child->ipc_fds[0], IPC_FD, child);
+                        fdset_add_fd(default_options.connections + AFP_LISTENERS + FDSET_SAFETY,
+                                     &fdset,
+                                     &polldata,
+                                     &fdset_used,
+                                     &fdset_size,
+                                     child->ipc_fds[0],
+                                     IPC_FD,
+                                     child);
                     }
                     break;
 
@@ -496,7 +520,14 @@ int main(int ac, char **av)
                         break;
                     }
                     child->disasociated = 1;
-                    fdset_add_fd(&fdset, &polldata, &fdset_used, &fdset_size, fd[0], IPC_FD, child);
+                    fdset_add_fd(default_options.connections + AFP_LISTENERS + FDSET_SAFETY,
+                                 &fdset,
+                                 &polldata,
+                                 &fdset_used,
+                                 &fdset_size,
+                                 fd[0],
+                                 IPC_FD,
+                                 child);
                     break;
 
                 default:

diff --git a/include/atalk/util.h b/include/atalk/util.h
index 277ac98975d7d430d50d999cfe6eb57ba7447bbb..6dcaabe260146fc56545829daf3c0a4c1b1d9812 100644 (file)
--- a/include/atalk/util.h
+++ b/include/atalk/util.h
@@ -154,7 +154,8 @@ struct polldata {
                          * pointer to afp_child_t for IPC fd             */
 };
 
-extern void fdset_add_fd(struct pollfd **fdsetp,
+extern void fdset_add_fd(int maxconns,
+                         struct pollfd **fdsetp,
                          struct polldata **polldatap,
                          int *fdset_usedp,
                          int *fdset_sizep,

diff --git a/libatalk/util/socket.c b/libatalk/util/socket.c
index 17b5058df6106f9506a7dd5e9f6532b70f6237a5..8d2300f2c908cadc4413331134f431fa51ca23ec 100644 (file)
--- a/libatalk/util/socket.c
+++ b/libatalk/util/socket.c
@@ -419,19 +419,16 @@ int compare_ip(const struct sockaddr *sa1, const struct sockaddr *sa2)
     return ret;
 }
 
-#define POLL_FD_SET_STARTSIZE 512
-#define POLL_FD_SET_INCREASE  128
 /*!
  * Add a fd to a dynamic pollfd array that is allocated and grown as needed
  *
  * This uses an additional array of struct polldata which stores type information
  * (enum fdtype) and a pointer to anciliary user data.
  *
- * 1. Allocate the arrays with an intial size of [POLL_FD_SET_STARTSIZE] if
- *    *fdsetp is NULL.
- * 2. Grow array as needed
- * 3. Fill in both array elements and increase count of used elements
+ * 1. Allocate the arrays with the size of "maxconns" if *fdsetp is NULL.
+ * 2. Fill in both array elements and increase count of used elements
  * 
+ * @param maxconns    (r)  maximum number of connections, determines array size
  * @param fdsetp      (rw) pointer to callers pointer to the pollfd array
  * @param polldatap   (rw) pointer to callers pointer to the polldata array
  * @param fdset_usedp (rw) pointer to an int with the number of used elements
@@ -440,7 +437,8 @@ int compare_ip(const struct sockaddr *sa1, const struct sockaddr *sa2)
  * @param fdtype      (r)  type of fd, currently IPC_FD or LISTEN_FD
  * @param data        (rw) pointer to data the caller want to associate with an fd
  */
-void fdset_add_fd(struct pollfd **fdsetp,
+void fdset_add_fd(int maxconns,
+                  struct pollfd **fdsetp,
                   struct polldata **polldatap,
                   int *fdset_usedp,
                   int *fdset_sizep,
@@ -455,37 +453,23 @@ void fdset_add_fd(struct pollfd **fdsetp,
     LOG(log_debug, logtype_default, "fdset_add_fd: adding fd %i in slot %i", fd, *fdset_usedp);
 
     if (fdset == NULL) { /* 1 */
-        /* Initialize with space for 512 fds */
-        fdset = calloc(POLL_FD_SET_STARTSIZE, sizeof(struct pollfd));
+        /* Initialize with space for all possibly active fds */
+        fdset = calloc(maxconns, sizeof(struct pollfd));
         if (! fdset)
             exit(EXITERR_SYS);
 
-        polldata = calloc(POLL_FD_SET_STARTSIZE, sizeof(struct polldata));
+        polldata = calloc(maxconns, sizeof(struct polldata));
         if (! polldata)
             exit(EXITERR_SYS);
 
-        fdset_size = 512;
-        *fdset_sizep = fdset_size;
-        *fdsetp = fdset;
-        *polldatap = polldata;
-    }
-
-    if (*fdset_usedp >= fdset_size) { /* 2 */
-        fdset = realloc(fdset, sizeof(struct pollfd) * (fdset_size + POLL_FD_SET_INCREASE));
-        if (fdset == NULL)
-            exit(EXITERR_SYS);
-
-        polldata = realloc(polldata, sizeof(struct polldata) * (fdset_size + POLL_FD_SET_INCREASE));
-        if (polldata == NULL)
-            exit(EXITERR_SYS);
+        fdset_size = maxconns;
 
-        fdset_size += POLL_FD_SET_INCREASE;
         *fdset_sizep = fdset_size;
         *fdsetp = fdset;
         *polldatap = polldata;
     }
 
-    /* 3 */
+    /* 2 */
     fdset[*fdset_usedp].fd = fd;
     fdset[*fdset_usedp].events = POLLIN;
     polldata[*fdset_usedp].fdtype = fdtype;