Browse Source

Kernel: Fix possible buffer overrun when scanning a MappedROM

If the length of the prefix was less than the chunk_size argument
we were potentionally reading past the mapped memory region.
Tom 3 năm trước cách đây
mục cha
commit
190572b714
1 tập tin đã thay đổi với 4 bổ sung1 xóa
  1. 4 1
      Kernel/Memory/MappedROM.h

+ 4 - 1
Kernel/Memory/MappedROM.h

@@ -23,7 +23,10 @@ public:
 
     Optional<PhysicalAddress> find_chunk_starting_with(StringView prefix, size_t chunk_size) const
     {
-        for (auto* candidate = base(); candidate < end(); candidate += chunk_size) {
+        auto prefix_length = prefix.length();
+        if (size < prefix_length)
+            return {};
+        for (auto* candidate = base(); candidate <= end() - prefix_length; candidate += chunk_size) {
             if (!__builtin_memcmp(prefix.characters_without_null_termination(), candidate, prefix.length()))
                 return paddr_of(candidate);
         }