From 0b5aa9d745b8c5a68005fce90a8989d8adf02b1c Mon Sep 17 00:00:00 2001
From: "wtc%netscape.com"
 <wtc%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 25 Jan 2002 19:16:34 +0000
Subject: [PATCH] Bugzilla bug 106496: fixed the WINNT version of
 PR_NewTCPSocketPair to verify the source of the connection.

git-svn-id: svn://10.0.0.236/trunk@112870 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/nsprpub/pr/src/io/prsocket.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/mozilla/nsprpub/pr/src/io/prsocket.c b/mozilla/nsprpub/pr/src/io/prsocket.c
index 8627923787e..eca44852886 100644
--- a/mozilla/nsprpub/pr/src/io/prsocket.c
+++ b/mozilla/nsprpub/pr/src/io/prsocket.c
@@ -1385,7 +1385,7 @@ PR_IMPLEMENT(PRStatus) PR_NewTCPSocketPair(PRFileDesc *f[])
      */
     SOCKET listenSock;
     SOCKET osfd[2];
-    struct sockaddr_in selfAddr;
+    struct sockaddr_in selfAddr, peerAddr;
     int addrLen;
 
     if (!_pr_initialized) _PR_ImplicitInitialization();
@@ -1429,10 +1429,24 @@ PR_IMPLEMENT(PRStatus) PR_NewTCPSocketPair(PRFileDesc *f[])
             addrLen) == SOCKET_ERROR) {
         goto failed;
     }
-    osfd[1] = accept(listenSock, NULL, NULL);
+    /*
+     * A malicious local process may connect to the listening
+     * socket, so we need to verify that the accepted connection
+     * is made from our own socket osfd[0].
+     */
+    if (getsockname(osfd[0], (struct sockaddr *) &selfAddr,
+            &addrLen) == SOCKET_ERROR) {
+        goto failed;
+    }
+    osfd[1] = accept(listenSock, (struct sockaddr *) &peerAddr, &addrLen);
     if (osfd[1] == INVALID_SOCKET) {
         goto failed;
     }
+    if (peerAddr.sin_port != selfAddr.sin_port) {
+        /* the connection we accepted is not from osfd[0] */
+        PR_SetError(PR_INSUFFICIENT_RESOURCES_ERROR, 0);
+        goto failed;
+    }
     closesocket(listenSock);
 
     f[0] = PR_AllocFileDesc(osfd[0], PR_GetTCPMethods());