From 0228c853f0aa50b01706c11c8008898bfdf1b789 Mon Sep 17 00:00:00 2001 From: Dimitry Andric Date: Fri, 1 Jan 2021 18:25:48 +0100 Subject: [PATCH] lib: Avoid declaring zero-length VLAs in various messaging functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In messaging_rec_create(), messaging_recv_cb() and messaging_dispatch_rec(), variable length arrays of file descriptors are declared using an incoming num_fds parameter. However, there are several scenarios where num_fds can be zero, and declaring a zero-length VLA is undefined behavior. This can lead to segmentation faults and/or other crashes when compiling with recent versions of clang at high optimization levels. To avoid ever using zero as the length for these declarations, use MAX(1, length) instead. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14605 Signed-off-by: Dimitry Andric Reviewed-by: Volker Lendecke Reviewed-by: Ralph Boehme Autobuild-User(master): Ralph Böhme Autobuild-Date(master): Mon Jan 4 10:50:07 UTC 2021 on sn-devel-184 (cherry picked from commit 3e96c95d41e4ccd0bf43b3ee78af644e2bc32e30) --- source3/lib/messages.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/lib/messages.c b/source3/lib/messages.c index c63b027c6179..448e5d5a2b67 100644 --- a/source3/lib/messages.c +++ b/source3/lib/messages.c @@ -157,7 +157,7 @@ struct messaging_rec *messaging_rec_create( { struct messaging_rec rec; - int64_t fds64[num_fds]; + int64_t fds64[MAX(1, num_fds)]; size_t i; for (i=0; ievent_ctx) { struct iovec iov; - int fds[rec->num_fds]; + int fds[MAX(1, rec->num_fds)]; int ret; /* -- 2.26.2