Bug 253

Summary: lbxproxy loops on display argument > MAXINT
Product: xorg Reporter: Alan Coopersmith <alan.coopersmith>
Component: Server/GeneralAssignee: Alan Coopersmith <alan.coopersmith>
Status: CLOSED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: unspecified   
Hardware: SPARC   
OS: Solaris   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
Patch to xc/programs/lbxproxy/os/connection.c none

Description Alan Coopersmith 2004-03-01 20:21:01 UTC
lbxproxy converts it's display agrument to an int without checking
for an integer overflow. It then uses this value in trying to establish
connections, increasing the number after each attempt (again, without
checking for an overflow):

jjj@enigma 486> lbxproxy :2147483648
Failed to establish all listening sockets for port number '2147483648'
Failed to establish all listening sockets for port number '-2147483647'
Failed to establish all listening sockets for port number '-2147483646'
Failed to establish all listening sockets for port number '-2147483645'
Failed to establish all listening sockets for port number '-2147483644'
Failed to establish all listening sockets for port number '-2147483643'
^C
Killed

This results in a large number of sockets in /tmp/.X11-unix:
[...]
X-2147483545  X-2147483569  X-2147483593  X-2147483617  X-2147483641
X-2147483546  X-2147483570  X-2147483594  X-2147483618  X-2147483642
X-2147483547  X-2147483571  X-2147483595  X-2147483619  X-2147483643
X-2147483548  X-2147483572  X-2147483596  X-2147483620  X-2147483644
X-2147483549  X-2147483573  X-2147483597  X-2147483621  X-2147483645
X-2147483550  X-2147483574  X-2147483598  X-2147483622  X-2147483646
X-2147483551  X-2147483575  X-2147483599  X-2147483623  X-2147483647
[...]

*** Test Case ***
Run 'lbxproxy :2147483648'
It should issue a single fatal error and exit without trying to open any
negative port numbers.
Comment 1 Alan Coopersmith 2004-03-01 20:21:55 UTC
Created attachment 114 [details] [review]
Patch to xc/programs/lbxproxy/os/connection.c
Comment 2 Alan Coopersmith 2004-03-01 20:31:24 UTC
Fix committed to XORG-CURRENT branch.
Comment 3 Jeremy Huddleston Sequoia 2011-09-27 10:21:16 UTC
Mass update: Close all bugs resolved over one year ago.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.