From c62142a72bd760f999a1f05b0547107cfda9fa11 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Mon, 18 Feb 2019 22:58:22 -0500 Subject: [PATCH] kernel: Add missing NULL check to _user_xsi_semget. Private semaphores will have a key of -1, but IPC_PRIVATE is 0, meaning it is possible to wind up here and get a NULL semaphoreSet if someone passes us an argument of -1. Reported on Twitter. --- src/system/kernel/posix/xsi_semaphore.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/system/kernel/posix/xsi_semaphore.cpp b/src/system/kernel/posix/xsi_semaphore.cpp index f4f4a2ea9a..a52028dc8c 100644 --- a/src/system/kernel/posix/xsi_semaphore.cpp +++ b/src/system/kernel/posix/xsi_semaphore.cpp @@ -771,8 +771,8 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags) MutexLocker _(sXsiSemaphoreSetLock); semaphoreSet = sSemaphoreHashTable.Lookup(semaphoreSetID); - if (!semaphoreSet->HasPermission()) { - TRACE_ERROR(("xsi_semget: calling process has not permission " + if (semaphoreSet == NULL || !semaphoreSet->HasPermission()) { + TRACE_ERROR(("xsi_semget: calling process has no permission " "on semaphore %d, key %d\n", semaphoreSet->ID(), (int)key)); return EACCES; @@ -815,9 +815,9 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags) MutexLocker _(sXsiSemaphoreSetLock); semaphoreSet->SetID(); - if (isPrivate) + if (isPrivate) { semaphoreSet->SetIpcKey((key_t)-1); - else { + } else { semaphoreSet->SetIpcKey(key); ipcKey->SetSemaphoreSetID(semaphoreSet); }