Просмотр исходного кода

Kernel: Fix accidental memory over-read in getsockopt(IP_TTL)

We were accidentally casting the pointer to m_ttl from an u8* to an int*
which resulted in copying of 3 extra unrelated bytes (which turned out
to be padding in this case).
Idan Horowitz 3 лет назад
Родитель
Сommit
20c7fcfedf
1 измененных файлов с 4 добавлено и 2 удалено
  1. 4 2
      Kernel/Net/IPv4Socket.cpp

+ 4 - 2
Kernel/Net/IPv4Socket.cpp

@@ -551,12 +551,14 @@ KResult IPv4Socket::getsockopt(OpenFileDescription& description, int level, int
     TRY(copy_from_user(&size, value_size.unsafe_userspace_ptr()));
 
     switch (option) {
-    case IP_TTL:
+    case IP_TTL: {
         if (size < sizeof(int))
             return EINVAL;
-        TRY(copy_to_user(static_ptr_cast<int*>(value), (int*)&m_ttl));
+        int ttl = m_ttl;
+        TRY(copy_to_user(static_ptr_cast<int*>(value), (int*)&ttl));
         size = sizeof(int);
         return copy_to_user(value_size, &size);
+    }
     case IP_MULTICAST_LOOP: {
         if (size < 1)
             return EINVAL;