Fix reporting of invalid timeouts in emulated pselect

3 files changed, 23 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index c04155975d..b830ff8f35 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2011-05-16  Ulrich Drepper  <drepper@gmail.com>
 
+	[BZ #11895]
+	* misc/pselect.c (__pselect): Handle timeout value errors hidden
+	through underflows.
+
 	[BZ #12766]
 	* misc/error.c (error_at_line): Ensure file_name and old_file_name
 	point to strings before performing equality test for error_one_per_line
diff --git a/NEWS b/NEWS
index ef27e60428..d8ced3cac8 100644
--- a/NEWS
+++ b/NEWS
@@ -10,13 +10,13 @@ Version 2.14
 * The following bugs are resolved with this release:
 
   386, 6420, 7101, 9730, 9732, 9809, 10138, 10149, 10157, 11257, 11258,
-  11487, 11532, 11578, 11653, 11668, 11697, 11724, 11820, 11901, 11945,
-  11947, 11952, 11987, 12052, 12083, 12158, 12178, 12200, 12346, 12393,
-  12420, 12432, 12445, 12449, 12453, 12454, 12460, 12469, 12489, 12509,
-  12510, 12511, 12518, 12527, 12541, 12545, 12551, 12582, 12583, 12587,
-  12597, 12601, 12611, 12625, 12626, 12631, 12650, 12653, 12655, 12660,
-  12681, 12685, 12711, 12713, 12714, 12717, 12723, 12724, 12734, 12738,
-  12746, 12766
+  11487, 11532, 11578, 11653, 11668, 11697, 11724, 11820, 11895, 11901,
+  11945, 11947, 11952, 11987, 12052, 12083, 12158, 12178, 12200, 12346,
+  12393, 12420, 12432, 12445, 12449, 12453, 12454, 12460, 12469, 12489,
+  12509, 12510, 12511, 12518, 12527, 12541, 12545, 12551, 12582, 12583,
+  12587, 12597, 12601, 12611, 12625, 12626, 12631, 12650, 12653, 12655,
+  12660, 12681, 12685, 12711, 12713, 12714, 12717, 12723, 12724, 12734,
+  12738, 12746, 12766
 
 * The RPC implementation in libc is obsoleted.  Old programs keep working
   but new programs cannot be linked with the routines in libc anymore.
diff --git a/misc/pselect.c b/misc/pselect.c
index 80cf8be4b3..e29d7b36ad 100644
--- a/misc/pselect.c
+++ b/misc/pselect.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-1998,2001,2002,2003,2006 Free Software Foundation, Inc.
+/* Copyright (C) 1996-1998,2001-2003,2006,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1996.
 
@@ -43,7 +43,17 @@ __pselect (int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds,
      precision and therefore the `pselect` should be available.  But
      for now it is hardly found.  */
   if (timeout != NULL)
-    TIMESPEC_TO_TIMEVAL (&tval, timeout);
+    {
+      /* Catch bugs which would be hidden by the TIMESPEC_TO_TIMEVAL
+	 computations.  The division by 1000 truncates values.  */
+      if (__builtin_expect (timeout->tv_nsec < 0, 0))
+	{
+	  __set_errno (EINVAL);
+	  return -1;
+	}
+
+      TIMESPEC_TO_TIMEVAL (&tval, timeout);
+    }
 
   /* The setting and restoring of the signal mask and the select call
      should be an atomic operation.  This can't be done without kernel