From 90201d5eca050414d50a433866ccb580415bb0d4 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Wed, 2 Oct 2013 16:11:30 -0700
Subject: [PATCH] FORTIFY_SOURCE: Add __FD_* checks

Add FORTIFY_SOURCE checks for the following macros:

* FD_CLR
* FD_ISSET
* FD_SET

Bug: 11047121
Change-Id: I3c5952136aec9eff3288b91b1318677ff971525c
---
 libc/Android.mk           |  1 +
 libc/bionic/__FD_chk.cpp  | 61 +++++++++++++++++++++++++++++++++++++++
 libc/include/sys/select.h | 15 ++++++++--
 tests/fortify_test.cpp    |  7 +++++
 4 files changed, 81 insertions(+), 3 deletions(-)
 create mode 100644 libc/bionic/__FD_chk.cpp

diff --git a/libc/Android.mk b/libc/Android.mk
index fc61c2710..c7478c52d 100644
--- a/libc/Android.mk
+++ b/libc/Android.mk
@@ -188,6 +188,7 @@ endif
 
 # Fortify implementations of libc functions.
 libc_common_src_files += \
+    bionic/__FD_chk.cpp \
     bionic/__fgets_chk.cpp \
     bionic/__memcpy_chk.cpp \
     bionic/__memmove_chk.cpp \
diff --git a/libc/bionic/__FD_chk.cpp b/libc/bionic/__FD_chk.cpp
new file mode 100644
index 000000000..c4b55de52
--- /dev/null
+++ b/libc/bionic/__FD_chk.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#undef _FORTIFY_SOURCE
+#include <sys/select.h>
+#include "libc_logging.h"
+
+extern "C" int __FD_ISSET_chk(int fd, fd_set* set) {
+  if (__predict_false(fd < 0)) {
+    __fortify_chk_fail("file descriptor is negative for FD_ISSET", 0);
+  }
+  if (__predict_false(fd >= FD_SETSIZE)) {
+    __fortify_chk_fail("file descriptor is too big for FD_ISSET", 0);
+  }
+  return FD_ISSET(fd, set);
+}
+
+extern "C" void __FD_CLR_chk(int fd, fd_set* set) {
+  if (__predict_false(fd < 0)) {
+    __fortify_chk_fail("file descriptor is negative for FD_CLR", 0);
+  }
+  if (__predict_false(fd >= FD_SETSIZE)) {
+    __fortify_chk_fail("file descriptor is too big for FD_CLR", 0);
+  }
+  FD_CLR(fd, set);
+}
+
+extern "C" void __FD_SET_chk(int fd, fd_set* set) {
+  if (__predict_false(fd < 0)) {
+    __fortify_chk_fail("file descriptor is negative for FD_SET", 0);
+  }
+  if (__predict_false(fd >= FD_SETSIZE)) {
+    __fortify_chk_fail("file descriptor is too big for FD_SET", 0);
+  }
+  FD_SET(fd, set);
+}
diff --git a/libc/include/sys/select.h b/libc/include/sys/select.h
index 8d7795798..c8cd8e15c 100644
--- a/libc/include/sys/select.h
+++ b/libc/include/sys/select.h
@@ -46,14 +46,23 @@ typedef struct {
 #define __FDELT(fd) ((fd) / __NFDBITS)
 #define __FDMASK(fd) (1UL << ((fd) % __NFDBITS))
 #define __FDS_BITS(set) (((fd_set*)(set))->fds_bits)
-
 #define __FD_CLR(fd, set) (__FDS_BITS(set)[__FDELT(fd)] &= ~__FDMASK(fd))
 #define __FD_SET(fd, set) (__FDS_BITS(set)[__FDELT(fd)] |= __FDMASK(fd))
-
 #define __FD_ISSET(fd, set) ((__FDS_BITS(set)[__FDELT(fd)] & __FDMASK(fd)) != 0)
-
 #define __FD_ZERO(set) (__builtin_memset(set, 0, sizeof(*(fd_set*)(set))))
 
+#if defined(__BIONIC_FORTIFY)
+extern void __FD_CLR_chk(int, fd_set*);
+extern void __FD_SET_chk(int, fd_set*);
+extern int  __FD_ISSET_chk(int, fd_set*);
+#undef __FD_CLR
+#undef __FD_SET
+#undef __FD_ISSET
+#define __FD_CLR(fd, set) __FD_CLR_chk(fd, set)
+#define __FD_SET(fd, set) __FD_SET_chk(fd, set)
+#define __FD_ISSET(fd, set) __FD_ISSET_chk(fd, set)
+#endif /* defined(__BIONIC_FORTIFY) */
+
 extern int select(int, fd_set*, fd_set*, fd_set*, struct timeval*);
 extern int pselect(int n, fd_set* read_fds, fd_set* write_fds, fd_set* err_fds,
                    const struct timespec * timeout, const sigset_t* sigmask);
diff --git a/tests/fortify_test.cpp b/tests/fortify_test.cpp
index b131fbe07..3a1bb93a3 100644
--- a/tests/fortify_test.cpp
+++ b/tests/fortify_test.cpp
@@ -547,6 +547,13 @@ TEST(DEATHTEST, recv_fortified) {
   ASSERT_EXIT(recv(0, buf, data_len, 0), testing::KilledBySignal(SIGABRT), "");
 }
 
+TEST(DEATHTEST, FD_ISSET_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  fd_set set;
+  memset(&set, 0, sizeof(set));
+  ASSERT_EXIT(FD_ISSET(-1, &set), testing::KilledBySignal(SIGABRT), "");
+}
+
 extern "C" char* __strncat_chk(char*, const char*, size_t, size_t);
 extern "C" char* __strcat_chk(char*, const char*, size_t);