mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-09-12 20:42:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Kernel: Avoid overrunning the user-specified buffers in select()

Browse source
This commit is contained in:
Gunnar Beutner 2021-04-28 08:36:37 +02:00 • committed by Andreas Kling
commit d9ee2c6a89
Notes: sideshowbarker 2024-07-18 19:00:01 +09:00
1 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Kernel/Syscalls/select.cpp
View file

@ -48,11 +48,16 @@ KResultOr<int> Process::sys$select(Userspace<const Syscall::SC_select_params*> u
}); });
fd_set fds_read, fds_write, fds_except; fd_set fds_read, fds_write, fds_except;
if (params.readfds && !copy_from_user(&fds_read, params.readfds))
size_t bytes_used = ceil_div(params.nfds, 8);
if (bytes_used > sizeof(fds_read))
return EINVAL;
if (params.readfds && !copy_from_user(&fds_read, params.readfds, bytes_used))
return EFAULT; return EFAULT;
if (params.writefds && !copy_from_user(&fds_write, params.writefds)) if (params.writefds && !copy_from_user(&fds_write, params.writefds, bytes_used))
return EFAULT; return EFAULT;
if (params.exceptfds && !copy_from_user(&fds_except, params.exceptfds)) if (params.exceptfds && !copy_from_user(&fds_except, params.exceptfds, bytes_used))
return EFAULT; return EFAULT;
Thread::SelectBlocker::FDVector fds_info; Thread::SelectBlocker::FDVector fds_info;
@ -111,11 +116,11 @@ KResultOr<int> Process::sys$select(Userspace<const Syscall::SC_select_params*> u
} }
} }
if (params.readfds && !copy_to_user(params.readfds, &fds_read)) if (params.readfds && !copy_to_user(params.readfds, &fds_read, bytes_used))
return EFAULT; return EFAULT;
if (params.writefds && !copy_to_user(params.writefds, &fds_write)) if (params.writefds && !copy_to_user(params.writefds, &fds_write, bytes_used))
return EFAULT; return EFAULT;
if (params.exceptfds && !copy_to_user(params.exceptfds, &fds_except)) if (params.exceptfds && !copy_to_user(params.exceptfds, &fds_except, bytes_used))
return EFAULT; return EFAULT;
return marked_fd_count; return marked_fd_count;
} }