diff options
author | Elliott Hughes <enh@google.com> | 2009-09-17 18:32:07 -0700 |
---|---|---|
committer | Elliott Hughes <enh@google.com> | 2009-09-18 11:52:23 -0700 |
commit | 42d8ce7a37c6c2245fa619843e9c240c1d2f3e46 (patch) | |
tree | 1b9439b068e00c38e4f6db53cc53c20dc4af2f73 /archive/src | |
parent | 3dfa79d310b5d304ab6b6328034271705e8057f9 (diff) | |
download | libcore-42d8ce7a37c6c2245fa619843e9c240c1d2f3e46.zip libcore-42d8ce7a37c6c2245fa619843e9c240c1d2f3e46.tar.gz libcore-42d8ce7a37c6c2245fa619843e9c240c1d2f3e46.tar.bz2 |
Fix heap corruption in nio select(2) code.
The active ingredient in this change is that we now test that the fd isn't -1,
used to represent an invalid fd. There's a race condition where a socket can be
closed between SelectorImpl.prepareChannels and the native code. This caused us
to write to the -1th element of a heap-allocated structure, leading to SIGSEGV.
I've also removed the check for an empty fd_set. It was broken before and will
never have fired, but I don't think it makes sense to fix it, given this race
condition.
The race can't be fixed because the implementation is documented to close the
socket channel and *then* cancel the selection key.
This patch also removes various dead functions and tidies up timeval usage.
Bug: 2093094
Diffstat (limited to 'archive/src')
0 files changed, 0 insertions, 0 deletions