LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-01-06 02:55:49 +03:00
Code Issues Packages Projects Releases Wiki Activity

Kernel: Pointer range validation should fail on wraparound

Browse Source 
Let's reject address ranges that wrap around the 2^32 mark.
This commit is contained in:
Andreas Kling 2019-12-31 18:23:17 +01:00
parent 903b159856
commit 36f1de3c89
Notes: sideshowbarker 2024-07-19 10:30:40 +09:00 
Author: https://github.com/awesomekling
Commit: https://github.com/SerenityOS/serenity/commit/36f1de3c898
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Kernel/Process.cpp
View File

@ -1971,6 +1971,8 @@ bool Process::validate_read(const void* address, ssize_t size) const
ASSERT(size >= 0);
VirtualAddress first_address((u32)address);
VirtualAddress last_address = first_address.offset(size - 1);
if (last_address < first_address)
return false;
if (is_ring0()) {
auto kmc_result = check_kernel_memory_access(first_address, false);
if (kmc_result == KernelMemoryCheckResult::AccessGranted)
@ -1995,6 +1997,8 @@ bool Process::validate_write(void* address, ssize_t size) const
ASSERT(size >= 0);
VirtualAddress first_address((u32)address);
VirtualAddress last_address = first_address.offset(size - 1);
if (last_address < first_address)
return false;
if (is_ring0()) {
if (is_kmalloc_address(address))
return true;