RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 19:27:45 +00:00
Code Issues Activity Actions

Kernel: Fix overflow in Process::validate_{read,write}_typed()

Browse source 
Userspace could pass us a large count to overflow the check. I'm not enough of a
haxx0r to write an actual exploit though.
This commit is contained in:
Sergey Bugaev 2020-05-31 21:56:17 +03:00 • committed by Andreas Kling
parent c3db694d9b
commit a77405665f
1 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
Kernel/Process.h
View file

@ -26,6 +26,7 @@
#pragma once #pragma once
#include <AK/Checked.h>
#include <AK/FixedArray.h> #include <AK/FixedArray.h>
#include <AK/HashMap.h> #include <AK/HashMap.h>
#include <AK/InlineLinkedList.h> #include <AK/InlineLinkedList.h>
@ -332,8 +333,17 @@ public:
[[nodiscard]] bool validate_read(const void*, size_t) const; [[nodiscard]] bool validate_read(const void*, size_t) const;
[[nodiscard]] bool validate_write(void*, size_t) const; [[nodiscard]] bool validate_write(void*, size_t) const;
template<typename T> template<typename T>
[[nodiscard]] bool validate_read_typed(T* value, size_t count = 1) { return validate_read(value, sizeof(T) * count); } [[nodiscard]] bool validate_read_typed(T* value, size_t count = 1)
{
Checked size = sizeof(T);
size *= count;
if (size.has_overflow())
return false;
return validate_read(value, size.value());
}
template<typename T> template<typename T>
[[nodiscard]] bool validate_read_and_copy_typed(T* dest, const T* src) [[nodiscard]] bool validate_read_and_copy_typed(T* dest, const T* src)
{ {
@ -343,8 +353,17 @@ public:
} }
return validated; return validated;
} }
template<typename T> template<typename T>
[[nodiscard]] bool validate_write_typed(T* value, size_t count = 1) { return validate_write(value, sizeof(T) * count); } [[nodiscard]] bool validate_write_typed(T* value, size_t count = 1)
{
Checked size = sizeof(T);
size *= count;
if (size.has_overflow())
return false;
return validate_write(value, size.value());
}
template<typename DataType, typename SizeType> template<typename DataType, typename SizeType>
[[nodiscard]] bool validate(const Syscall::MutableBufferArgument<DataType, SizeType>&); [[nodiscard]] bool validate(const Syscall::MutableBufferArgument<DataType, SizeType>&);
template<typename DataType, typename SizeType> template<typename DataType, typename SizeType>