From 1339ccf411dd372ce69edd091e46349c179b4cf1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Axel=20D=C3=B6rfler?= Date: Tue, 8 Dec 2009 15:28:44 +0000 Subject: [PATCH] * Enforce that the caller of transfer_area() owns the area - this fixes some mean crashes with the media_server version I just checked in. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@34556 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/system/kernel/vm/vm.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/system/kernel/vm/vm.cpp b/src/system/kernel/vm/vm.cpp index d0a38b03c8..c7265d3f0e 100644 --- a/src/system/kernel/vm/vm.cpp +++ b/src/system/kernel/vm/vm.cpp @@ -4731,7 +4731,7 @@ resize_area(area_id areaID, size_t newSize) /*! Transfers the specified area to a new team. The caller must be the owner - of the area (not yet enforced but probably should be). + of the area. */ area_id transfer_area(area_id id, void** _address, uint32 addressSpec, team_id target, @@ -4742,6 +4742,9 @@ transfer_area(area_id id, void** _address, uint32 addressSpec, team_id target, if (status != B_OK) return status; + if (info.team != thread_get_current_thread()->team->id) + return B_PERMISSION_DENIED; + area_id clonedArea = vm_clone_area(target, info.name, _address, addressSpec, info.protection, REGION_NO_PRIVATE_MAP, id, kernel); if (clonedArea < 0)