* process.c: Add sanity checks for file descriptors.

(wait_reading_process_output, Fprocess_filter_multibyte_p):
Check that infd is nonnegative before using it as an fd.
(read_and_dispose_of_process_output, Fprocess_send_eof):
Likewise, for outfd.
(wait_reading_process_output): Omit unnecessary check of infd.

Fixes: debbugs:17844

diff --git a/src/ChangeLog b/src/ChangeLog
index 2e6ad094382baebd7149d1bf26b4bad8665af296..e854c2e1c39332611d02050bcdff539edc301980 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2014-07-08  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * process.c: Add sanity checks for file descriptors (Bug#17844).
+       (wait_reading_process_output, Fprocess_filter_multibyte_p):
+       Check that infd is nonnegative before using it as an fd.
+       (read_and_dispose_of_process_output, Fprocess_send_eof):
+       Likewise, for outfd.
+       (wait_reading_process_output): Omit unnecessary check of infd.
+
 2014-07-07  Paul Eggert  <eggert@cs.ucla.edu>
 
        Minor fixups related to usage of the 'long' type.

diff --git a/src/process.c b/src/process.c
index 3242222a94a9de93b51452ac9dd9794a655cc9a9..d1b14533c9952d6187cc50103752eecc76fb656f 100644 (file)
--- a/src/process.c
+++ b/src/process.c
@@ -4462,6 +4462,7 @@ wait_reading_process_output (intmax_t time_limit, int nsecs, int read_kbd,
       if (wait_proc && wait_proc->raw_status_new)
        update_status (wait_proc);
       if (wait_proc
+         && wait_proc->infd >= 0
          && ! EQ (wait_proc->status, Qrun)
          && ! EQ (wait_proc->status, Qconnect))
        {
@@ -4471,7 +4472,7 @@ wait_reading_process_output (intmax_t time_limit, int nsecs, int read_kbd,
          XSETPROCESS (proc, wait_proc);
 
          /* Read data from the process, until we exhaust it.  */
-         while (wait_proc->infd >= 0)
+         while (true)
            {
              int nread = read_process_output (proc, wait_proc->infd);
              if (nread < 0)
@@ -4642,6 +4643,7 @@ wait_reading_process_output (intmax_t time_limit, int nsecs, int read_kbd,
                          > 0))
                    {
                      nfds = 1;
+                     eassert (0 <= wait_proc->infd);
                      /* Set to Available.  */
                      FD_SET (wait_proc->infd, &Available);
                    }
@@ -4909,7 +4911,8 @@ wait_reading_process_output (intmax_t time_limit, int nsecs, int read_kbd,
                     status_notify to do it later, it will read input
                     from the process before calling the sentinel.  */
                  exec_sentinel (proc, build_string ("open\n"));
-                 if (!EQ (p->filter, Qt) && !EQ (p->command, Qt))
+                 if (0 <= p->infd && !EQ (p->filter, Qt)
+                     && !EQ (p->command, Qt))
                    {
                      FD_SET (p->infd, &input_wait_mask);
                      FD_SET (p->infd, &non_keyboard_wait_mask);
@@ -5131,7 +5134,7 @@ read_and_dispose_of_process_output (struct Lisp_Process *p, char *chars,
         proc_encode_coding_system[p->outfd] surely points to a
         valid memory because p->outfd will be changed once EOF is
         sent to the process.  */
-      if (NILP (p->encode_coding_system)
+      if (NILP (p->encode_coding_system) && p->outfd
          && proc_encode_coding_system[p->outfd])
        {
          pset_encode_coding_system
@@ -6071,8 +6074,8 @@ process has been transmitted to the serial port.  */)
         for communication with the subprocess, call shutdown to cause EOF.
         (In some old system, shutdown to socketpair doesn't work.
         Then we just can't win.)  */
-      if (EQ (p->type, Qnetwork)
-         || p->infd == old_outfd)
+      if (0 <= old_outfd
+         && (EQ (p->type, Qnetwork) || p->infd == old_outfd))
        shutdown (old_outfd, 1);
 #endif
       close_process_fd (&p->open_fd[WRITE_TO_SUBPROCESS]);
@@ -6546,6 +6549,8 @@ DEFUN ("process-filter-multibyte-p", Fprocess_filter_multibyte_p,
 
   CHECK_PROCESS (process);
   p = XPROCESS (process);
+  if (p->infd < 0)
+    return Qnil;
   coding = proc_decode_coding_system[p->infd];
   return (CODING_FOR_UNIBYTE (coding) ? Qnil : Qt);
 }