microsoft / omi

Open Management Infrastructure
Other
368 stars 116 forks source link

crash caused by FD_SET buffer overflow in _GetSockEvents when the sock (fd) is >=1024 #625

Closed oldzhu closed 5 years ago

oldzhu commented 5 years ago

(gdb) bt

0 0x00007feb4cbc2529 in abort () from /lib/x86_64-linux-gnu/libc.so.6

1 0x00007feb4cbfec00 in ?? () from /lib/x86_64-linux-gnu/libc.so.6

2 0x00007feb4cc871f7 in __fortify_fail () from /lib/x86_64-linux-gnu/libc.so.6

3 0x00007feb4cc85330 in __chk_fail () from /lib/x86_64-linux-gnu/libc.so.6

4 0x00007feb4cc8716a in __fdelt_warn () from /lib/x86_64-linux-gnu/libc.so.6

5 0x00007fea64a03173 in _GetSockEvents (p=0x7fea980f7790, p=0x7fea980f7790, mask=, rep=0x7feb4004ebe0) at ../sock/selector.c:420

6 Selector_Run (self=self@entry=0x7fea64c798a0 , timeoutUsec=timeoutUsec@entry=0, noReadsMode=noReadsMode@entry=0 '\000') at ../sock/selector.c:677

7 0x00007fea649bd85e in InteractionProtocolHandler_Selector_RunThread (threadParam=) at InteractionProtocolHandler.c:2425

8 0x00007fea64a0550f in _Wrapper (param=0x7feb40157c40) at thread.c:33

9 0x00007feb4d7d1494 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0

10 0x00007feb4cc76acf in clone () from /lib/x86_64-linux-gnu/libc.so.6

To create more than 1024 powershell tasks could reproduce the similar crash easily.

This is the same as the problem described in the below post

https://stackoverflow.com/questions/22827510/how-to-avoid-bad-fd-set-buffer-overflow-crash .... To avoid the problem with FD_SETSIZE, several writers, for example Increasing limit of FD_SETSIZE and select, suggest using poll rather than select. .....

JumpingYang001 commented 5 years ago

@oldzhu good catch! I will think how to fix it in our code.

JumpingYang001 commented 5 years ago

this is by design, powershell need to close the session, on other omi based products, they will invoke close.