Bug 1760611 - Add file descriptor sanity checks in NSPR poll. r=glandium

Thanks to Jesse Schwartzentruber for the suggestion.

1 files changed, 6 insertions, 1 deletions

diff --git a/pr/src/md/unix/unix.c b/pr/src/md/unix/unix.c
index d9e35925..f71d1f66 100644
--- a/pr/src/md/unix/unix.c
+++ b/pr/src/md/unix/unix.c
@@ -3641,7 +3641,8 @@ int poll(struct pollfd *filedes, unsigned long nfds, int timeout)
         int events = filedes[i].events;
         PRBool fdHasEvent = PR_FALSE;
 
-        if (osfd < 0) {
+        PR_ASSERT(osfd < FD_SETSIZE);
+        if (osfd < 0 || osfd >= FD_SETSIZE) {
             continue;  /* Skip this osfd. */
         }
 
@@ -3686,6 +3687,10 @@ int poll(struct pollfd *filedes, unsigned long nfds, int timeout)
             if (filedes[i].fd < 0) {
                 continue;
             }
+            if (filedes[i].fd >= FD_SETSIZE) {
+                filedes[i].revents |= POLLNVAL;
+                continue;
+            }
             if (FD_ISSET(filedes[i].fd, &rd)) {
                 if (filedes[i].events & POLLIN) {
                     filedes[i].revents |= POLLIN;