RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 19:07:35 +00:00
Code Issues Activity Actions

strace: Fix out-of-bounds read when formatting realpath()

Browse source 
The actual length of the resulting string is encoded in the return
value; treating the entire buffer as a string leads to reading
uninitialized memory.
This commit is contained in:
Daniel Bertalan 2021-12-22 13:49:14 +01:00 • committed by Andreas Kling
parent 8e3d1a42e3
commit a73c71e877
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Utilities/strace.cpp
View file

@ -452,10 +452,10 @@ static void format_getrandom(FormattedSyscallBuilder& builder, void* buffer, siz
builder.add_arguments(buffer, size, flags); builder.add_arguments(buffer, size, flags);
} }
static void format_realpath(FormattedSyscallBuilder& builder, Syscall::SC_realpath_params* params_p) static void format_realpath(FormattedSyscallBuilder& builder, Syscall::SC_realpath_params* params_p, size_t length)
{ {
auto params = copy_from_process(params_p).release_value_but_fixme_should_propagate_errors(); auto params = copy_from_process(params_p).release_value_but_fixme_should_propagate_errors();
builder.add_arguments(StringArgument { params.path }, StringArgument { { params.buffer.data, params.buffer.size } }); builder.add_arguments(StringArgument { params.path }, StringArgument { { params.buffer.data, min(params.buffer.size, length) } });
} }
static void format_exit(FormattedSyscallBuilder& builder, int status) static void format_exit(FormattedSyscallBuilder& builder, int status)
@ -748,7 +748,7 @@ static void format_syscall(FormattedSyscallBuilder& builder, Syscall::Function s
result_type = Ssize; result_type = Ssize;
break; break;
case SC_realpath: case SC_realpath:
format_realpath(builder, (Syscall::SC_realpath_params*)arg1); format_realpath(builder, (Syscall::SC_realpath_params*)arg1, (size_t)res);
break; break;
case SC_recvmsg: case SC_recvmsg:
format_recvmsg(builder, (int)arg1, (struct msghdr*)arg2, (int)arg3); format_recvmsg(builder, (int)arg1, (struct msghdr*)arg2, (int)arg3);