risto kankkunen veyjhbyfbuaeanjperlorg new ticket created risto kankkunen please include string perl 46309 subject line future correspondence issue bug report perl jztovfamrtsomrfsecurecom generated help perlbug 135 running perl v587 ive found nasty buffer overflow problem win32_select function made product using embedded perl unreliable currently using version 587 checked problematic code 588 problem happens select sets specified case code uses dummy variable place actual bit vector win32win32sckc282 int win32_selectint nfds perl_fd_set rd perl_fd_set wr perl_fd_set ex const struct timeval timeout int r ifdef use_sockets_as_handles perl_fd_set dummy win32win32sckc304 rd rd dummy prd null perl_fd_set defined win32includesyssocketh26 ifndef perl_fd_setsize define perl_fd_setsize 64 endif define perl_bits_per_byte 8 define perl_nfdbits sizeofperl_fd_maskperl_bits_per_byte typedef int perl_fd_mask typedef struct perl_fd_set perl_fd_mask bitsperl_fd_setsizeperl_nfdbits1perl_nfdbits perl_fd_set socket number exceeds 63 code writes end dummy destroying local variables return address win32win32sckc334 0 nfds fd to_socketi perl_fd_issetird fd_issetfd nrd perl_fd_clrird easily repro problem attached socketcrashpl script attached patch fixes buffer overflow eliminating dummy variable regards risto kankkunen socketcrashpl use strict use warnings use iosocket sub fhbits fhlist _ mybits vecbitsfileno_1 1 fhlist return bits handles 12000 handle new iosocket domainaf_inet protoudp peeraddr1270028888 die pushhandles handle printf handlesddn filenohandles0 filenohandles1 rin fhbitshandles rout wout eout count timeleft selectroutrin woutundef eoutundef 1 print countcountn print timelefttimeleftn printf rin v08bn rin printf routv08bn rout 0 printf woutv08bn wout 0 printf eoutv08bn eout 0 win32_selectpatch index perlsrcwin32win32sckc perlsrcwin32win32sckc revision 3794 perlsrcwin32win32sckc working copy 2879 2878 int r ifdef use_sockets_as_handles perl_fd_set dummy int fd save_errno errno fd_set nrd nwr nex prd pwr pex fd_set nrd nwr nex winsock seems incapable dealing three null fd_sets millisecond sleep special case 30344 30231 return 0 startsockets perl_fd_zerodummy rd rd dummy prd null else prd nrd wr wr dummy pwr null else pwr nwr ex ex dummy pex null else pex nex fd_zeronrd fd_zeronwr fd_zeronex 0 nfds fd to_socketi perl_fd_issetird rd perl_fd_issetird fd_setunsignedfd nrd perl_fd_issetiwr wr perl_fd_issetiwr fd_setunsignedfd nwr perl_fd_issetiex ex perl_fd_issetiex fd_setunsignedfd nex errno save_errno socket_test_errorr selectnfds prd pwr pex timeout socket_test_errorr selectnfds nrd nwr nex timeout save_errno errno 0 nfds fd to_socketi perl_fd_issetird fd_issetfd nrd rd perl_fd_issetird fd_issetfd nrd perl_fd_clrird perl_fd_issetiwr fd_issetfd nwr wr perl_fd_issetiwr fd_issetfd nwr perl_fd_clriwr perl_fd_issetiex fd_issetfd nex ex perl_fd_issetiex fd_issetfd nex perl_fd_clriex errno save_errno flags categorycore severityhigh site configuration information perl v587 configured kankri mon oct 30 151416 2006 summary perl5 revision 5 version 8 subversion 7 configuration platform osnamemswin32 osvers51 archnamemswin32x86multithread uname config_argsundef hintrecommended useposixtrue d_sigactionundef usethreadsdefine use5005threadsundef useithreadsdefine usemultiplicitydefine useperliodefine d_sfioundef uselargefilesdefine usesocksundef use64bitintundef use64bitallundef uselongdoubleundef usemymallocn bincompat5005undef compiler cccl ccflags nologo gf w3 md zi dndebug o1 dwin32 d_console dno_strict dhave_des_fcrypt dperl_no_exit dperl_implicit_context dperl_implicit_sys duse_perlio dperl_msvcrt_readfix optimizemd zi dndebug o1 cppflagsdwin32 ccversion12008804 gccversion gccosandvers intsize4 longsize4 ptrsize4 doublesize8 byteorder1234 d_longlongundef longlongsize8 d_longdbldefine longdblsize10 ivtypelong ivsize4 nvtypedouble nvsize8 off_t__int64 lseeksize8 alignbytes8 prototypedefine linker libraries ldlink ldflags nologo nodefaultlib debug optreficf libpathcfsperllibcore machinex86 libpthlib libs oldnameslib kernel32lib user32lib gdi32lib winspoollib comdlg32lib advapi32lib shell32lib ole32lib oleaut32lib netapi32lib uuidlib ws2_32lib mprlib winmmlib versionlib odbc32lib odbccp32lib msvcrtlib perllibs oldnameslib kernel32lib user32lib gdi32lib winspoollib comdlg32lib advapi32lib shell32lib ole32lib oleaut32lib netapi32lib uuidlib ws2_32lib mprlib winmmlib versionlib odbc32lib odbccp32lib msvcrtlib libcmsvcrtlib sodll useshrplibyes libperlfspl58lib gnulibc_versionundef dynamic linking dlsrcdl_win32xs dlextdll d_dlsymunundef ccdlflags cccdlflags lddlflagsdll nologo nodefaultlib debug optreficf libpathcfsperllibcore machinex86 locally applied patches inc perl v587 cfsperllib cfsperlsitelib environment perl v587 home unset lang unset language unset ld_library_path unset logdir unset path perl_badlang unset shell unset tue 05 aug 2008 130607 0700 perl 46309 buffer overflow win32_select patch included