svc.c: svc_getreqset() buffer overflow

http://bugs.busybox.net/show_bug.cgi?id=5588

Signed-off-by: Leonid Lisovskiy <lly.dev@gmail.com>
Signed-off-by: Waldemar Brodkorb <wbx@uclibc-ng.org>

diff --git a/libc/inet/rpc/svc.c b/libc/inet/rpc/svc.c
index 6d7253a..c3d5518 100644 (file)
--- a/libc/inet/rpc/svc.c
+++ b/libc/inet/rpc/svc.c
@@ -448,6 +448,8 @@ svc_getreqset (fd_set *readfds)
   register int bit;
 
   setsize = _rpc_dtablesize ();
+  if (setsize > FD_SETSIZE)
+    setsize = FD_SETSIZE;
   maskp = (u_int32_t *) readfds->fds_bits;
   for (sock = 0; sock < setsize; sock += 32)
     for (mask = *maskp++; (bit = ffs (mask)); mask ^= (1 << (bit - 1)))