RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 05:47:35 +00:00
Code Issues Activity Actions

Kernel: Fix wrong sizeof() type in sys$execve() argument overflow check

Browse source
This commit is contained in:
Andreas Kling 2021-02-14 00:14:17 +01:00
parent 34a83aba71
commit ffdfbf1dba
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Kernel/Syscalls/execve.cpp
View file

@ -885,13 +885,13 @@ int Process::sys$execve(Userspace<const Syscall::SC_execve_params*> user_params)
auto copy_user_strings = [](const auto& list, auto& output) { auto copy_user_strings = [](const auto& list, auto& output) {
if (!list.length) if (!list.length)
return true; return true;
Checked size = sizeof(list.strings); Checked size = sizeof(*list.strings);
size *= list.length; size *= list.length;
if (size.has_overflow()) if (size.has_overflow())
return false; return false;
Vector<Syscall::StringArgument, 32> strings; Vector<Syscall::StringArgument, 32> strings;
strings.resize(list.length); strings.resize(list.length);
if (!copy_from_user(strings.data(), list.strings, list.length * sizeof(Syscall::StringArgument))) if (!copy_from_user(strings.data(), list.strings, list.length * sizeof(*list.strings)))
return false; return false;
for (size_t i = 0; i < list.length; ++i) { for (size_t i = 0; i < list.length; ++i) {
auto string = copy_string_from_user(strings[i]); auto string = copy_string_from_user(strings[i]);