bindresvport() uses two static variables port and startport which are not

protected. It is not safe when in multithread circumstance.

bindresvport() select a port number from the range 512 to 1023, when in
multithread circumstance, the port may be 1024. So the static variables will be
protected.

Signed-off-by: Peng Haitao <penght@cn.fujitsu.com>
Reviewed-by: Carlos O'Donell <carlos@systemhalted.org>

1 files changed, 11 insertions, 0 deletions

diff --git a/sunrpc/bindrsvprt.c b/sunrpc/bindrsvprt.c
index d493c9f23e..e6a1b0b0b3 100644
--- a/sunrpc/bindrsvprt.c
+++ b/sunrpc/bindrsvprt.c
@@ -35,6 +35,12 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <bits/libc-lock.h>
+
+/*
+ * Locks the static variables in this file.
+ */
+__libc_lock_define_initialized (static, lock);
 
 /*
  * Bind a socket to a privileged IP port
@@ -74,6 +80,9 @@ bindresvport (int sd, struct sockaddr_in *sin)
 
   int nports = ENDPORT - startport + 1;
   int endport = ENDPORT;
+
+  __libc_lock_lock (lock);
+
  again:
   for (i = 0; i < nports; ++i)
     {
@@ -94,6 +103,8 @@ bindresvport (int sd, struct sockaddr_in *sin)
       goto again;
     }
 
+  __libc_lock_unlock (lock);
+
   return res;
 }
 libc_hidden_def (bindresvport)