Coverity complains (CID
1005726) that we might pass -1 as the fd
argument to send() in slirp_send(), because we previously checked for
"so->s == -1 && so->extra". The case of "so->s == -1 but so->extra
NULL" should not in theory happen, but it is hard to guarantee
because various places in the code do so->s = qemu_socket(...) and so
will end up with so->s == -1 on failure, and not all the paths which
call that always throw away the socket in that case (eg
tcp_fconnect()). So just check specifically for the condition and
fail slirp_send().
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
return len;
}
+ if (so->s == -1) {
+ /*
+ * This should in theory not happen but it is hard to be
+ * sure because some code paths will end up with so->s == -1
+ * on a failure but don't dispose of the struct socket.
+ * Check specifically, so we don't pass -1 to send().
+ */
+ errno = EBADF;
+ return -1;
+ }
+
return send(so->s, buf, len, flags);
}