Description: Don't add descriptor over FD_SETSIZE to fd_set ConnectionNumber in X11_Pending may return a value outside of the range [0, FD_SETSIZE). This value cannot be stored inside a fd_set and will crash the program. . This buffer overflow problem occasionally happens when a lot of file descriptors are used. Author: Sven Eckelmann --- diff --git a/src/video/x11/SDL_x11events.c b/src/video/x11/SDL_x11events.c index 818ab2e21d96fa80c0b6ba72551198e5e9f925b2..5a983208a1a7c5d7d3a1a88bfac0c4337a2f4ed1 100644 --- a/src/video/x11/SDL_x11events.c +++ b/src/video/x11/SDL_x11events.c @@ -917,6 +917,9 @@ X11_Pending(Display * display) fd_set fdset; x11_fd = ConnectionNumber(display); + if (x11_fd >= FD_SETSIZE || x11_fd < 0) + return 0; + FD_ZERO(&fdset); FD_SET(x11_fd, &fdset); if (select(x11_fd + 1, &fdset, NULL, NULL, &zero_time) == 1) {