From d7e0104ae4da25f455630aae044adf165201c9b5 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 10 Nov 2025 20:31:26 +0900 Subject: treewide: reject impossible user-supplied fd These are all trusted user input, however this check reduces the likelihood of hard to debug errors. Signed-off-by: Ophestra --- internal/outcome/main.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'internal') diff --git a/internal/outcome/main.go b/internal/outcome/main.go index a32d220a..1f02fafb 100644 --- a/internal/outcome/main.go +++ b/internal/outcome/main.go @@ -4,13 +4,26 @@ import ( "context" "log" "time" + _ "unsafe" // for go:linkname "hakurei.app/hst" "hakurei.app/message" ) +// IsPollDescriptor reports whether fd is the descriptor being used by the poller. +// +//go:linkname IsPollDescriptor internal/poll.IsPollDescriptor +func IsPollDescriptor(fd uintptr) bool + // Main runs an app according to [hst.Config] and terminates. Main does not return. func Main(ctx context.Context, msg message.Msg, config *hst.Config, fd int) { + // avoids runtime internals or standard streams + if fd >= 0 { + if IsPollDescriptor(uintptr(fd)) || fd < 3 { + log.Fatalf("invalid identifier fd %d", fd) + } + } + var id hst.ID if err := hst.NewInstanceID(&id); err != nil { log.Fatal(err.Error()) -- cgit v1.3.1