Unsafe usage of select() can lead to stack corruption about pam_radius HOT 2 CLOSED

Wow... that's utterly retarded. Which version of Linux are you using? I don't see any such notes on the ones I have.

from pam_radius.

Here is an online version: http://man7.org/linux/man-pages/man2/select.2.html#NOTES

I am refering to the following:
An fd_set is a fixed size buffer. Executing FD_CLR() or FD_SET() with a value of fd that is negative or is equal to or larger than FD_SETSIZE will result in undefined behavior. Moreover, POSIX requires fd to be a valid file descriptor.

It's not really obvious, but internally the select() uses a 1024 bit wide field, which is why going over this boundary will corrupt the process' memory.
At the very least we should fail gracefully (maybe by returning PAM_ABORT) when the limit is crossed.

Unfortunately i am still wresting with github on how i can submit a patch via a pull request ;-)

from pam_radius.