RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 00:57:45 +00:00
Code Issues Activity Actions

Kernel: Harden sys$execve Vector usage against OOM.

Browse source
This commit is contained in:
Brian Gianforcaro 2021-04-29 01:40:19 -07:00 • committed by Andreas Kling
parent 454d2fd42a
commit 119b7be249
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Kernel/Syscalls/execve.cpp
View file

@ -96,13 +96,15 @@ static KResultOr<FlatPtr> make_userspace_stack_for_main_thread(Region& region, V
Vector<FlatPtr> argv_entries; Vector<FlatPtr> argv_entries;
for (auto& argument : arguments) { for (auto& argument : arguments) {
push_string_on_new_stack(argument); push_string_on_new_stack(argument);
argv_entries.append(new_esp); if (!argv_entries.try_append(new_esp))
return ENOMEM;
} }
Vector<FlatPtr> env_entries; Vector<FlatPtr> env_entries;
for (auto& variable : environment) { for (auto& variable : environment) {
push_string_on_new_stack(variable); push_string_on_new_stack(variable);
env_entries.append(new_esp); if (!env_entries.try_append(new_esp))
return ENOMEM;
} }
for (auto& value : auxiliary_values) { for (auto& value : auxiliary_values) {
@ -912,14 +914,16 @@ KResultOr<int> Process::sys$execve(Userspace<const Syscall::SC_execve_params*> u
if (size.has_overflow()) if (size.has_overflow())
return false; return false;
Vector<Syscall::StringArgument, 32> strings; Vector<Syscall::StringArgument, 32> strings;
strings.resize(list.length); if (!strings.try_resize(list.length))
return false;
if (!copy_from_user(strings.data(), list.strings, list.length * sizeof(*list.strings))) if (!copy_from_user(strings.data(), list.strings, list.length * sizeof(*list.strings)))
return false; return false;
for (size_t i = 0; i < list.length; ++i) { for (size_t i = 0; i < list.length; ++i) {
auto string = copy_string_from_user(strings[i]); auto string = copy_string_from_user(strings[i]);
if (string.is_null()) if (string.is_null())
return false; return false;
output.append(move(string)); if (!output.try_append(move(string)))
return false;
} }
return true; return true;
}; };