Tcl Source Code

Tcl_MakeFileChannel(3) checks if the given fd is a tty or a socket before assuming it's a file.
If there are pledge(2)es in effect that are restricting the usage of network functions then Tcl_MakeFileChannel will segfault when it tries to use getsockname(2) to check if the fd is a socket.
An important time when this happens is when tclsh is fed a script on stdin: tclsh will immediately segfault.
By using fstat(2) to first check if the fd is a socket, a call to getsockname might be avoided.
This may have security implications.

Attached is a patch against 8.6.8.
The patch has the nice side effect of putting all the socket bits in one place.

Here is a test program:

#include <unistd.h>
#define TCLSH "/usr/local/bin/tclsh"
int main (int argc, char *argv[]) {
        char *a[] = { TCLSH, NULL };
        char *e[] = { NULL };

#ifdef DNS
        pledge(NULL, "stdio rpath getpw dns");
#else
# ifdef INET
        pledge(NULL, "stdio rpath getpw inet");
# else
        pledge(NULL, "stdio rpath getpw");
# endif
#endif

        execve(TCLSH, a, e);
        return 0;
}

$ cc -o tpl tpl.c
$ echo 'puts moo' | ./tpl
Abort trap (core dumped) 

$ cc -o tpl tpl.c -DINET
$ echo 'puts moo' | ./tpl
moo