RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 21:37:35 +00:00
Code Issues Activity Actions

Kernel: Validate ftruncate(fd, length) syscall inputs

Browse source 
- EINVAL if 'length' is negative
- EBADF if 'fd' is not open for writing
This commit is contained in:
Andreas Kling 2020-01-07 14:42:56 +01:00
parent bb9db9d430
commit 6a4b376021
2 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Kernel/Process.cpp
View file

@ -3424,10 +3424,13 @@ int Process::sys$rename(const char* oldpath, const char* newpath)
int Process::sys$ftruncate(int fd, off_t length) int Process::sys$ftruncate(int fd, off_t length)
{ {
if (length < 0)
return -EINVAL;
auto* description = file_description(fd); auto* description = file_description(fd);
if (!description) if (!description)
return -EBADF; return -EBADF;
// FIXME: Check that fd is writable, otherwise EINVAL. if (!description->is_writable())
return -EBADF;
return description->truncate(length); return description->truncate(length);
} }

20
Userland/test_io.cpp
View file

@ -87,6 +87,24 @@ void test_read_past_eof()
ASSERT(rc == 0); ASSERT(rc == 0);
} }
void test_ftruncate_readonly()
{
int fd = open("/tmp/trunctest", O_RDONLY | O_CREAT, 0666);
ASSERT(fd >= 0);
int rc;
EXPECT_ERROR_2(EBADF, ftruncate, fd, 0);
close(fd);
}
void test_ftruncate_negative()
{
int fd = open("/tmp/trunctest", O_RDWR | O_CREAT, 0666);
ASSERT(fd >= 0);
int rc;
EXPECT_ERROR_2(EINVAL, ftruncate, fd, -1);
close(fd);
}
int main(int, char**) int main(int, char**)
{ {
int rc; int rc;
@ -103,6 +121,8 @@ int main(int, char**)
test_read_from_writeonly(); test_read_from_writeonly();
test_write_to_readonly(); test_write_to_readonly();
test_read_past_eof(); test_read_past_eof();
test_ftruncate_readonly();
test_ftruncate_negative();
return 0; return 0;
} }