RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 16:17:45 +00:00
Code Issues Activity Actions

Kernel: When validating a string read, validate the pointer first.

Browse source 
Calling strlen() on an invalid pointer is just gonna crash the process.
This commit is contained in:
Andreas Kling 2019-02-08 00:10:01 +01:00
parent 887b4a7a1a
commit f4bce03716
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Kernel/Process.cpp
View file

@ -1643,6 +1643,13 @@ bool Process::validate_read_from_kernel(LinearAddress laddr) const
return validate_read(laddr.as_ptr(), 1); return validate_read(laddr.as_ptr(), 1);
} }
bool Process::validate_read_str(const char* str)
{
if (!validate_read(str, 1))
return false;
return validate_read(str, strlen(str) + 1);
}
bool Process::validate_read(const void* address, size_t size) const bool Process::validate_read(const void* address, size_t size) const
{ {
if (is_ring0()) { if (is_ring0()) {

2
Kernel/Process.h
View file

@ -267,7 +267,7 @@ public:
bool validate_read(const void*, size_t) const; bool validate_read(const void*, size_t) const;
bool validate_write(void*, size_t) const; bool validate_write(void*, size_t) const;
bool validate_read_str(const char* str) { return validate_read(str, strlen(str) + 1); } bool validate_read_str(const char* str);
template<typename T> bool validate_read_typed(T* value, size_t count = 1) { return validate_read(value, sizeof(T) * count); } template<typename T> bool validate_read_typed(T* value, size_t count = 1) { return validate_read(value, sizeof(T) * count); }
template<typename T> bool validate_write_typed(T* value, size_t count = 1) { return validate_write(value, sizeof(T) * count); } template<typename T> bool validate_write_typed(T* value, size_t count = 1) { return validate_write(value, sizeof(T) * count); }