beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 15:40:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Kernel: Fix overflow in Process::validate_{read,write}_typed()

Browse source 
Userspace could pass us a large count to overflow the check. I'm not enough of a
haxx0r to write an actual exploit though.
This commit is contained in:
Sergey Bugaev 2020-05-31 21:56:17 +03:00 committed by Andreas Kling
parent c3db694d9b
commit a77405665f
Notes: sideshowbarker 2024-07-19 05:55:26 +09:00 
Author: https://github.com/bugaevc
Commit: https://github.com/SerenityOS/serenity/commit/a77405665f4
Pull-request: https://github.com/SerenityOS/serenity/pull/2468
1 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
Kernel/Process.h
View file

@ -26,6 +26,7 @@
#pragma once
#include <AK/Checked.h>
#include <AK/FixedArray.h>
#include <AK/HashMap.h>
#include <AK/InlineLinkedList.h>
@ -332,8 +333,17 @@ public:
[[nodiscard]] bool validate_read(const void*, size_t) const;
[[nodiscard]] bool validate_write(void*, size_t) const;
template<typename T>
[[nodiscard]] bool validate_read_typed(T* value, size_t count = 1) { return validate_read(value, sizeof(T) * count); }
[[nodiscard]] bool validate_read_typed(T* value, size_t count = 1)
{
Checked size = sizeof(T);
size *= count;
if (size.has_overflow())
return false;
return validate_read(value, size.value());
}
template<typename T>
[[nodiscard]] bool validate_read_and_copy_typed(T* dest, const T* src)
{
@ -343,8 +353,17 @@ public:
}
return validated;
}
template<typename T>
[[nodiscard]] bool validate_write_typed(T* value, size_t count = 1) { return validate_write(value, sizeof(T) * count); }
[[nodiscard]] bool validate_write_typed(T* value, size_t count = 1)
{
Checked size = sizeof(T);
size *= count;
if (size.has_overflow())
return false;
return validate_write(value, size.value());
}
template<typename DataType, typename SizeType>
[[nodiscard]] bool validate(const Syscall::MutableBufferArgument<DataType, SizeType>&);
template<typename DataType, typename SizeType>