bugzilla-daemon at bugzilla
Aug 18, 2009, 1:46 PM
Post #2 of 8
(1239 views)
Permalink
|
|
[Bug 1633] Race condition in ssh-agent AUTH_CONNECTION
[In reply to]
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=1633
--- Comment #2 from Damien Miller <djm [at] mindrot> 2009-08-19 06:46:27 EST ---
... and here is a theory on how it occurs:
on a heavily loaded ssh-agent, we can create a new socket in the
ssh-agent.c:after_select() loop, via the AUTH_SOCKET case calling
new_socket(). This might increase sockets_alloc past the value it had
when execution enters after_select().
The for() loop in after_select() can therefore progress into sockets
that did not exist when select() and, critically, prepare_select() was
called. prepare_select() sizes and clears the fd_sets that select()
subsequently populates and after_select() tests.
So a new AUTH_CONNECTION socket whose creation increments sockets_alloc
can cause after_select to test past the end of the allocated fd_sets
and might (depending on what it finds) treat them as ready for reading.
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
|
