RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 07:58:11 +00:00
Code Issues Activity Actions

Kernel: writev() should fail with EINVAL if total length > INT32_MAX

Browse source
This commit is contained in:
Andreas Kling 2020-01-02 13:01:41 +01:00
parent 7f04334664
commit c01f766fb2
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Kernel/Process.cpp
View file

@ -40,6 +40,7 @@
#include <Kernel/VM/InodeVMObject.h>
#include <Kernel/VM/PurgeableVMObject.h>
#include <LibC/errno_numbers.h>
#include <LibC/limits.h>
#include <LibC/signal_numbers.h>
#include <LibELF/ELFLoader.h>
#include <LibELF/exec_elf.h>
@ -1272,7 +1273,12 @@ ssize_t Process::sys$writev(int fd, const struct iovec* iov, int iov_count)
if (!validate_read_typed(iov, iov_count))
return -EFAULT;
// FIXME: Return EINVAL if sum of iovecs is greater than INT_MAX
u64 total_length = 0;
for (int i = 0; i < iov_count; ++i) {
total_length += iov[i].iov_len;
if (total_length > INT32_MAX)
return -EINVAL;
}
auto* description = file_description(fd);
if (!description)