[Python-checkins] cpython (merge 3.2 -> default): Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was

[jesus.cea]

http://hg.python.org/cpython/rev/74434cff2c90
changeset:   72436:74434cff2c90
parent:      72433:c372a79c771e
parent:      72435:447770470d00
user:        Jesus Cea <jcea at jcea.es>
date:        Wed Sep 21 03:56:05 2011 +0200
summary:
  Close #13022: _multiprocessing.recvfd() doesn't check that file descriptor was actually received

files:
  Lib/test/test_multiprocessing.py           |  17 ++++++++++
  Misc/NEWS                                  |   3 +
  Modules/_multiprocessing/multiprocessing.c |  11 ++++++
  3 files changed, 31 insertions(+), 0 deletions(-)


diff --git a/Lib/test/test_multiprocessing.py b/Lib/test/test_multiprocessing.py
--- a/Lib/test/test_multiprocessing.py
+++ b/Lib/test/test_multiprocessing.py
@@ -1689,6 +1689,23 @@
         with open(test.support.TESTFN, "rb") as f:
             self.assertEqual(f.read(), b"bar")
 
+    @classmethod
+    def _send_data_without_fd(self, conn):
+        os.write(conn.fileno(), b"\0")
+
+    @unittest.skipIf(sys.platform == "win32", "doesn't make sense on Windows")
+    def test_missing_fd_transfer(self):
+        # Check that exception is raised when received data is not
+        # accompanied by a file descriptor in ancillary data.
+        if self.TYPE != 'processes':
+            self.skipTest("only makes sense with processes")
+        conn, child_conn = self.Pipe(duplex=True)
+
+        p = self.Process(target=self._send_data_without_fd, args=(child_conn,))
+        p.daemon = True
+        p.start()
+        self.assertRaises(RuntimeError, reduction.recv_handle, conn)
+        p.join()
 
 class _TestListenerClient(BaseTestCase):
 
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -1287,6 +1287,9 @@
 Extension Modules
 -----------------
 
+- Issue #13022: Fix: _multiprocessing.recvfd() doesn't check that
+  file descriptor was actually received.
+
 - Issue #1172711: Add 'long long' support to the array module.
   Initial patch by Oren Tirosh and Hirokazu Yamamoto.
 
diff --git a/Modules/_multiprocessing/multiprocessing.c b/Modules/_multiprocessing/multiprocessing.c
--- a/Modules/_multiprocessing/multiprocessing.c
+++ b/Modules/_multiprocessing/multiprocessing.c
@@ -166,6 +166,17 @@
     if (res < 0)
         return PyErr_SetFromErrno(PyExc_OSError);
 
+    if (msg.msg_controllen < CMSG_LEN(sizeof(int)) ||
+        (cmsg = CMSG_FIRSTHDR(&msg)) == NULL ||
+        cmsg->cmsg_level != SOL_SOCKET ||
+        cmsg->cmsg_type != SCM_RIGHTS ||
+        cmsg->cmsg_len < CMSG_LEN(sizeof(int))) {
+        /* If at least one control message is present, there should be
+           no room for any further data in the buffer. */
+        PyErr_SetString(PyExc_RuntimeError, "No file descriptor received");
+        return NULL;
+    }
+
     fd = * (int *) CMSG_DATA(cmsg);
     return Py_BuildValue("i", fd);
 }

-- 
Repository URL: http://hg.python.org/cpython