[PATCH] fhandler_pipe: add sanity limit to handle loops

[Jeremy Drake]

On Sat, 25 Dec 2021, Takashi Yano wrote:

> Could you please try
> assert(phi->NumberOfHandles <= n_handle)
> rather than
> assert(phi->NumberOfHandles < n_handle)
> ?

I thought of that when I was re-reading my email.  I also added a printf:

index 9ce140089..4d10451c1 100644
--- a/winsup/cygwin/fhandler_pipe.cc
+++ b/winsup/cygwin/fhandler_pipe.cc
@@ -11,6 +11,7 @@ details. */
 #include "winsup.h"
 #include <stdlib.h>
 #include <sys/socket.h>
+#include <assert.h>
 #include "cygerrno.h"
 #include "security.h"
 #include "path.h"
@@ -1271,6 +1272,13 @@ fhandler_pipe::get_query_hdl_per_process (WCHAR *name,
      if (!NT_SUCCESS (status))
        goto close_proc;

+      if (phi->NumberOfHandles > n_handle)
+        {
+          small_printf ("phi->NumberOfHandles = %lu, n_handle = %lu\n",
+              (unsigned long) phi->NumberOfHandles,
+              (unsigned long) n_handle);
+          assert(phi->NumberOfHandles <= n_handle);
+        }
       for (ULONG j = 0; j < phi->NumberOfHandles; j++)
        {
          /* Check for the peculiarity of cygwin read pipe */

phi->NumberOfHandles = 7999168, n_handle = 256
assertion "phi->NumberOfHandles <= n_handle" failed: file
"../../.././winsup/cygwin/fhandler_pipe.cc", line 1280, function: void*
fhandler_pipe::get_query_hdl_per_process(WCHAR*, OBJECT_NAME_INFORMATION*)
Aborted