[Python-checkins] cpython (3.2): Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was

Wed Sep 21 03:56:11 CEST 2011

http://hg.python.org/cpython/rev/447770470d00
changeset: 72435:447770470d00
branch: 3.2
parent: 72428:e06db421e4c4
user: Jesus Cea <jcea at jcea.es>
date: Wed Sep 21 03:53:25 2011 +0200
summary:
 Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was actually received
files:
 Lib/test/test_multiprocessing.py | 17 ++++++++++
 Misc/NEWS | 3 +
 Modules/_multiprocessing/multiprocessing.c | 11 ++++++
 3 files changed, 31 insertions(+), 0 deletions(-)

diff --git a/Lib/test/test_multiprocessing.py b/Lib/test/test_multiprocessing.py
--- a/Lib/test/test_multiprocessing.py
+++ b/Lib/test/test_multiprocessing.py
@@ -1632,6 +1632,23 @@
 with open(test.support.TESTFN, "rb") as f:
 self.assertEqual(f.read(), b"bar")
 
+ @classmethod
+ def _send_data_without_fd(self, conn):
+ os.write(conn.fileno(), b"0円")
+
+ @unittest.skipIf(sys.platform == "win32", "doesn't make sense on Windows")
+ def test_missing_fd_transfer(self):
+ # Check that exception is raised when received data is not
+ # accompanied by a file descriptor in ancillary data.
+ if self.TYPE != 'processes':
+ self.skipTest("only makes sense with processes")
+ conn, child_conn = self.Pipe(duplex=True)
+
+ p = self.Process(target=self._send_data_without_fd, args=(child_conn,))
+ p.daemon = True
+ p.start()
+ self.assertRaises(RuntimeError, reduction.recv_handle, conn)
+ p.join()
 
 class _TestListenerClient(BaseTestCase):
 
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -78,6 +78,9 @@
 Extension Modules
 -----------------
 
+- Issue #13022: Fix: _multiprocessing.recvfd() doesn't check that
+ file descriptor was actually received.
+
 - Issue #12483: ctypes: Fix a crash when the destruction of a callback
 object triggers the garbage collector.
 
diff --git a/Modules/_multiprocessing/multiprocessing.c b/Modules/_multiprocessing/multiprocessing.c
--- a/Modules/_multiprocessing/multiprocessing.c
+++ b/Modules/_multiprocessing/multiprocessing.c
@@ -177,6 +177,17 @@
 if (res < 0)
 return PyErr_SetFromErrno(PyExc_OSError);
 
+ if (msg.msg_controllen < CMSG_LEN(sizeof(int)) ||
+ (cmsg = CMSG_FIRSTHDR(&msg)) == NULL ||
+ cmsg->cmsg_level != SOL_SOCKET ||
+ cmsg->cmsg_type != SCM_RIGHTS ||
+ cmsg->cmsg_len < CMSG_LEN(sizeof(int))) {
+ /* If at least one control message is present, there should be
+ no room for any further data in the buffer. */
+ PyErr_SetString(PyExc_RuntimeError, "No file descriptor received");
+ return NULL;
+ }
+
 fd = * (int *) CMSG_DATA(cmsg);
 return Py_BuildValue("i", fd);
 }
-- 
Repository URL: http://hg.python.org/cpython
