RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 04:32:44 +00:00
Code Issues Activity Actions

Kernel: Harden sys$sendmsg / sys$recvmsg Vector usage against OOM.

Browse source
This commit is contained in:
Brian Gianforcaro 2021-04-29 01:11:24 -07:00 • committed by Andreas Kling
parent 6288ae2c37
commit cd29eb7867
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Kernel/Syscalls/socket.cpp
View file

@ -178,7 +178,8 @@ KResultOr<ssize_t> Process::sys$sendmsg(int sockfd, Userspace<const struct msghd
if (msg.msg_iovlen != 1) if (msg.msg_iovlen != 1)
return ENOTSUP; // FIXME: Support this :) return ENOTSUP; // FIXME: Support this :)
Vector<iovec, 1> iovs; Vector<iovec, 1> iovs;
iovs.resize(msg.msg_iovlen); if (!iovs.try_resize(msg.msg_iovlen))
return ENOMEM;
if (!copy_n_from_user(iovs.data(), msg.msg_iov, msg.msg_iovlen)) if (!copy_n_from_user(iovs.data(), msg.msg_iov, msg.msg_iovlen))
return EFAULT; return EFAULT;
@ -213,7 +214,8 @@ KResultOr<ssize_t> Process::sys$recvmsg(int sockfd, Userspace<struct msghdr*> us
if (msg.msg_iovlen != 1) if (msg.msg_iovlen != 1)
return ENOTSUP; // FIXME: Support this :) return ENOTSUP; // FIXME: Support this :)
Vector<iovec, 1> iovs; Vector<iovec, 1> iovs;
iovs.resize(msg.msg_iovlen); if (!iovs.try_resize(msg.msg_iovlen))
return ENOMEM;
if (!copy_n_from_user(iovs.data(), msg.msg_iov, msg.msg_iovlen)) if (!copy_n_from_user(iovs.data(), msg.msg_iov, msg.msg_iovlen))
return EFAULT; return EFAULT;