Browse Source

Kernel: Fix info leak from padding in GenericFramebufferDevice::ioctl

In FB_IOCTL_GET_PROPERTIES we were not initializing the padding of the
struct, leading to the potential of an kernel information leak if the
caller looked back at it's contents.

Lets just be extra paranoid and zero initialize all these structs
in we store on the stack while handling ioctls(..).
Brian Gianforcaro 3 năm trước cách đây
mục cha
commit
98990dce53
1 tập tin đã thay đổi với 3 bổ sung3 xóa
  1. 3 3
      Kernel/Graphics/GenericFramebufferDevice.cpp

+ 3 - 3
Kernel/Graphics/GenericFramebufferDevice.cpp

@@ -37,7 +37,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
     switch (request) {
     case FB_IOCTL_GET_PROPERTIES: {
         auto user_properties = static_ptr_cast<FBProperties*>(arg);
-        FBProperties properties;
+        FBProperties properties {};
         auto adapter = m_graphics_adapter.strong_ref();
         if (!adapter)
             return Error::from_errno(EIO);
@@ -49,7 +49,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
     }
     case FB_IOCTL_GET_HEAD_PROPERTIES: {
         auto user_head_properties = static_ptr_cast<FBHeadProperties*>(arg);
-        FBHeadProperties head_properties;
+        FBHeadProperties head_properties {};
         TRY(copy_from_user(&head_properties, user_head_properties));
         TRY(verify_head_index(head_properties.head_index));
 
@@ -86,7 +86,7 @@ ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned req
     }
     case FB_IOCTL_GET_HEAD_VERTICAL_OFFSET_BUFFER: {
         auto user_head_vertical_buffer_offset = static_ptr_cast<FBHeadVerticalOffset*>(arg);
-        FBHeadVerticalOffset head_vertical_buffer_offset;
+        FBHeadVerticalOffset head_vertical_buffer_offset {};
         TRY(copy_from_user(&head_vertical_buffer_offset, user_head_vertical_buffer_offset));
         TRY(verify_head_index(head_vertical_buffer_offset.head_index));