From 44831711fcad79cb2cc6c9ac3937bc766bcce670 Mon Sep 17 00:00:00 2001 From: Hendrik Date: Sun, 25 Jan 2026 15:42:17 +0100 Subject: [PATCH] Fix out of bounds read and write in IO.select Added error handling for file descriptors larger than FD_SETSIZE in mrb_hal_io_fdset_set and mrb_hal_io_fdset_isset functions, for posix hal. I actually don't know how to fix this on windows, or if it needs fixing. --- mrbgems/hal-posix-io/src/io_hal.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/mrbgems/hal-posix-io/src/io_hal.c b/mrbgems/hal-posix-io/src/io_hal.c index bba87ce33..bf3f1630b 100644 --- a/mrbgems/hal-posix-io/src/io_hal.c +++ b/mrbgems/hal-posix-io/src/io_hal.c @@ -519,6 +519,10 @@ void mrb_hal_io_fdset_set(mrb_state *mrb, int fd, mrb_io_fdset *fdset) { (void)mrb; + if (fd >= FD_SETSIZE) { + mrb_raise(mrb, E_ARGUMENT_ERROR, "fd is larger than FD_SETSIZE"); + return; + } if (fdset) { FD_SET(fd, &fdset->fds); } @@ -528,6 +532,10 @@ int mrb_hal_io_fdset_isset(mrb_state *mrb, int fd, mrb_io_fdset *fdset) { (void)mrb; + if (fd >= FD_SETSIZE) { + mrb_raise(mrb, E_ARGUMENT_ERROR, "fd is larger than FD_SETSIZE"); + return 0; + } if (fdset) { return FD_ISSET(fd, &fdset->fds); }