[PATCH] fhandler_pipe: add sanity limit to handle loops

[Ken Brown]

On 12/23/2021 6:10 PM, Jeremy Drake via Cygwin-patches wrote:
> diff --git a/winsup/cygwin/fhandler_pipe.cc
> b/winsup/cygwin/fhandler_pipe.cc
> index ba6b70f55..48713a38d 100644
> --- a/winsup/cygwin/fhandler_pipe.cc
> +++ b/winsup/cygwin/fhandler_pipe.cc
> @@ -1239,7 +1239,7 @@ fhandler_pipe::get_query_hdl_per_process (WCHAR *name,
>         if (!NT_SUCCESS (status))
>          goto close_proc;
> 
> -      for (ULONG j = 0; j < phi->NumberOfHandles; j++)
> +      for (ULONG j = 0; j < min(phi->NumberOfHandles, n_handle); j++)

Reading the preceding code, I don't see how n_handle could be less than 
phi->NumberOfHandles.  Can you explain?

>          {
>            /* Check for the peculiarity of cygwin read pipe */
>            const ULONG access = FILE_READ_DATA | FILE_READ_EA
> @@ -1309,7 +1309,7 @@ fhandler_pipe::get_query_hdl_per_system (WCHAR *name,
>     if (!NT_SUCCESS (status))
>       return NULL;
> 
> -  for (LONG i = (LONG) shi->NumberOfHandles - 1; i >= 0; i--)
> +  for (LONG i = (LONG) min(shi->NumberOfHandles, n_handle) - 1; i >= 0; i--)

Same comment.

Ken