LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-20 01:37:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Kernel: writev() should fail with EINVAL if total length > INT32_MAX

Browse Source
This commit is contained in:
Andreas Kling 2020-01-02 13:01:41 +01:00
parent 7f04334664
commit c01f766fb2
Notes: sideshowbarker 2024-07-19 10:25:53 +09:00 
Author: https://github.com/awesomekling
Commit: https://github.com/SerenityOS/serenity/commit/c01f766fb2d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Kernel/Process.cpp
View File

@ -40,6 +40,7 @@
#include <Kernel/VM/InodeVMObject.h>
#include <Kernel/VM/PurgeableVMObject.h>
#include <LibC/errno_numbers.h>
#include <LibC/limits.h>
#include <LibC/signal_numbers.h>
#include <LibELF/ELFLoader.h>
#include <LibELF/exec_elf.h>
@ -1272,7 +1273,12 @@ ssize_t Process::sys$writev(int fd, const struct iovec* iov, int iov_count)
if (!validate_read_typed(iov, iov_count))
return -EFAULT;
// FIXME: Return EINVAL if sum of iovecs is greater than INT_MAX
u64 total_length = 0;
for (int i = 0; i < iov_count; ++i) {
total_length += iov[i].iov_len;
if (total_length > INT32_MAX)
return -EINVAL;
}
auto* description = file_description(fd);
if (!description)