2006-04-26 Dick Porter <dick@ximian.com>

        * sockets.c (WSAIoctl): Check the output buffer is valid before
        writing to it.

        * handles.c (_wapi_search_handle): Set shared pointer if we find a
        shared handle that has been already opened.

2006-04-26  Dick Porter  <dick@ximian.com>

        * socket-io.c (hostent_to_IPHostEntry2): Explicitly check for NULL
        dereference.

svn path=/trunk/mono/; revision=59930

diff --git a/mono/io-layer/ChangeLog b/mono/io-layer/ChangeLog
index 51dbf696bada6a9aa4b3c10efbb2c741e2f7a8fd..e2f6b233659b67f85cbe322f5307846ca06b33ef 100644 (file)
--- a/mono/io-layer/ChangeLog
+++ b/mono/io-layer/ChangeLog
@@ -1,3 +1,11 @@
+2006-04-26  Dick Porter  <dick@ximian.com>
+
+       * sockets.c (WSAIoctl): Check the output buffer is valid before
+       writing to it.
+
+       * handles.c (_wapi_search_handle): Set shared pointer if we find a
+       shared handle that has been already opened.
+
 2006-04-21  Dick Porter  <dick@ximian.com>
 
        * threads.c (GetCurrentThread): Reference the handle if we return

diff --git a/mono/io-layer/handles.c b/mono/io-layer/handles.c
index a27540bca6e5d2ca39eb218b8dca994f660469ca..77f0a6c2c6ed2e535cf774710d1d8d50f830aa7a 100644 (file)
--- a/mono/io-layer/handles.c
+++ b/mono/io-layer/handles.c
@@ -673,6 +673,11 @@ gpointer _wapi_search_handle (WapiHandleType type,
                                if (check (ret, user_data) == TRUE) {
                                        _wapi_handle_ref (ret);
                                        found = TRUE;
+
+                                       if (_WAPI_SHARED_HANDLE (type)) {
+                                               shared = &_wapi_shared_layout->handles[i];
+                                       }
+                                       
                                        break;
                                }
                        }

diff --git a/mono/io-layer/sockets.c b/mono/io-layer/sockets.c
index 51592e164177bd023196981c233642a5f758fb59..f830414395f8a98accaf97f70ca1254bb63f48bc 100644 (file)
--- a/mono/io-layer/sockets.c
+++ b/mono/io-layer/sockets.c
@@ -794,9 +794,15 @@ WSAIoctl (guint32 fd, gint32 command,
        } else {
                /* We just copy the buffer to the output. Some ioctls
                 * don't even output any data, but, well...
+                *
+                * NB windows returns WSAEFAULT if o_len is too small
                 */
                i_len = (i_len > o_len) ? o_len : i_len;
-               memcpy (output, buffer, i_len);
+
+               if (i_len > 0 && output != NULL) {
+                       memcpy (output, buffer, i_len);
+               }
+               
                g_free (buffer);
                *written = i_len;
        }

diff --git a/mono/metadata/ChangeLog b/mono/metadata/ChangeLog
index 8a569e81b53a5a1898c928dedf1c43c5e08b0ed5..7416fd24989c797b914907411980e61db667e784 100644 (file)
--- a/mono/metadata/ChangeLog
+++ b/mono/metadata/ChangeLog
@@ -1,3 +1,8 @@
+2006-04-26  Dick Porter  <dick@ximian.com>
+
+       * socket-io.c (hostent_to_IPHostEntry2): Explicitly check for NULL
+       dereference.
+
 2006-04-25  Martin Baulig  <martin@ximian.com>
 
        * mono-debug.h (MONO_DEBUGGER_VERSION): Bump to 56.

diff --git a/mono/metadata/socket-io.c b/mono/metadata/socket-io.c
index c10e2bf11736ba6a137392199b84c4089d8a5e7e..831b59230d590b2d5a528976d0eb1524ac8529a5 100644 (file)
--- a/mono/metadata/socket-io.c
+++ b/mono/metadata/socket-io.c
@@ -2187,7 +2187,8 @@ static gboolean hostent_to_IPHostEntry2(struct hostent *he1,struct hostent *he2,
                        mono_array_setref (*h_aliases, i, alias);
                        i++;
                }
-       } else if (family_hint == PF_UNSPEC || family_hint == PF_INET6) {
+       } else if (he2 != NULL && (family_hint == PF_UNSPEC ||
+                                  family_hint == PF_INET6)) {
                *h_name=mono_string_new (domain, he2->h_name);
 
                i=0;
@@ -2205,6 +2206,8 @@ static gboolean hostent_to_IPHostEntry2(struct hostent *he1,struct hostent *he2,
                        mono_array_setref (*h_aliases, i, alias);
                        i++;
                }
+       } else {
+               return(FALSE);
        }
 
        /*