tests: bound-check descriptors before FD_SET in bandwidth server

The benchmark server inserted the listen socket and every accepted client
socket into a stack fd_set with FD_SET and no FD_SETSIZE check. With
enough open descriptors, accept() returns a descriptor >= FD_SETSIZE and
FD_SET then writes out of bounds of the fd_set (stack corruption).
Refuse/close descriptors >= FD_SETSIZE before FD_SET. A real server
should use poll()/epoll(). Project Vanessa L021/L022 (CWE-787).

Reported-by: Aaron (NVIDIA)

Author: stephane

tests/bandwidth-server-many-up.c

@@ -73,7 +73,17 @@ int main(void)
 
     /* Clear the reference set of socket */
     FD_ZERO(&refset);
-    /* Add the server socket */
+    /* Add the server socket (modbus_tcp_listen already guarantees the
+     * descriptor is below FD_SETSIZE, but check defensively before FD_SET). */
+    if (server_socket >= FD_SETSIZE) {
+        fprintf(stderr,
+                "Server socket %d exceeds FD_SETSIZE (%d)\n",
+                server_socket,
+                FD_SETSIZE);
+        close(server_socket);
+        modbus_free(ctx);
+        return -1;
+    }
     FD_SET(server_socket, &refset);
 
     /* Keep track of the max file descriptor */
@@ -106,6 +116,15 @@ int main(void)
                 newfd = accept(server_socket, (struct sockaddr *) &clientaddr, &addrlen);
                 if (newfd == -1) {
                     perror("Server accept() error");
+                } else if (newfd >= FD_SETSIZE) {
+                    /* fd_set/FD_SET cannot represent a descriptor >= FD_SETSIZE;
+                     * setting it would corrupt the stack. Refuse the connection
+                     * instead. A real server should use poll()/epoll(). */
+                    fprintf(stderr,
+                            "Refusing socket %d: exceeds FD_SETSIZE (%d)\n",
+                            newfd,
+                            FD_SETSIZE);
+                    close(newfd);
                 } else {
                     FD_SET(newfd, &refset);