LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-20 01:37:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Kernel: Validate the requested range in allocate_region_with_vmobject()

Browse Source
This commit is contained in:
Andreas Kling 2020-01-18 14:37:22 +01:00
parent aa63de53bd
commit 9c9fe62a4b
Notes: sideshowbarker 2024-07-19 09:59:01 +09:00 
Author: https://github.com/awesomekling
Commit: https://github.com/SerenityOS/serenity/commit/9c9fe62a4b9
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Kernel/Process.cpp
View File

@ -194,6 +194,19 @@ Region* Process::allocate_file_backed_region(VirtualAddress vaddr, size_t size,
Region* Process::allocate_region_with_vmobject(VirtualAddress vaddr, size_t size, NonnullRefPtr<VMObject> vmobject, size_t offset_in_vmobject, const String& name, int prot, bool user_accessible) Region* Process::allocate_region_with_vmobject(VirtualAddress vaddr, size_t size, NonnullRefPtr<VMObject> vmobject, size_t offset_in_vmobject, const String& name, int prot, bool user_accessible)
{ {
size_t end_in_vmobject = offset_in_vmobject + size;
if (end_in_vmobject < offset_in_vmobject) {
dbgprintf("allocate_region_with_vmobject: Overflow (offset + size)\n");
return nullptr;
}
if (offset_in_vmobject >= vmobject->size()) {
dbgprintf("allocate_region_with_vmobject: Attempt to allocate a region with an offset past the end of its VMObject.\n");
return nullptr;
}
if (end_in_vmobject > vmobject->size()) {
dbgprintf("allocate_region_with_vmobject: Attempt to allocate a region with an end past the end of its VMObject.\n");
return nullptr;
}
auto range = allocate_range(vaddr, size); auto range = allocate_range(vaddr, size);
if (!range.is_valid()) if (!range.is_valid())
return nullptr; return nullptr;
@ -666,7 +679,6 @@ int Process::do_exec(NonnullRefPtr<FileDescription> main_program_description, Ve
{ {
ASSERT(is_ring3()); ASSERT(is_ring3());
auto path = main_program_description->absolute_path(); auto path = main_program_description->absolute_path();
dbgprintf("%s(%d) do_exec(%s): thread_count() = %d\n", m_name.characters(), m_pid, path.characters(), thread_count()); dbgprintf("%s(%d) do_exec(%s): thread_count() = %d\n", m_name.characters(), m_pid, path.characters(), thread_count());
// FIXME(Thread): Kill any threads the moment we commit to the exec(). // FIXME(Thread): Kill any threads the moment we commit to the exec().
if (thread_count() != 1) { if (thread_count() != 1) {