mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 19:37:35 +00:00
Kernel: Fix buffer overflow in VirtIOGPU create_3d_resource(..)
This code attempts to copy the `Protocol::Resource3DSpecification` struct into request, starting at `Protocol::ResourceCreate3D::target` member of the `Protocol::ResourceCreate3D` struct. The problem is that the `Protocol::Resource3DSpecification` struct does not having the trailing `u32 padding` that the `ResourceCreate3D` struct has. Leading to memcopy overrunning the struct and corrupting 32 bits of data trailing the struct. Found by SonarCloud: - Memory copy function overflows the destination buffer.
This commit is contained in:
parent
af50895fa3
commit
c0ed656c94
3 changed files with 7 additions and 2 deletions
|
@ -284,7 +284,10 @@ ResourceID GraphicsAdapter::create_3d_resource(Protocol::Resource3DSpecification
|
|||
request.resource_id = resource_id.value();
|
||||
// TODO: Abstract this out a bit more
|
||||
u32* start_of_copied_fields = &request.target;
|
||||
memcpy(start_of_copied_fields, &resource_3d_specification, sizeof(Protocol::Resource3DSpecification));
|
||||
|
||||
// Validate that the sub copy from the resource_3d_specification to the offset of the request fits.
|
||||
static_assert((sizeof(request) - offsetof(Protocol::ResourceCreate3D, target) == sizeof(resource_3d_specification)));
|
||||
memcpy(start_of_copied_fields, &resource_3d_specification, sizeof(resource_3d_specification));
|
||||
|
||||
synchronous_virtio_gpu_command(start_of_scratch_space(), sizeof(request), sizeof(response));
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue