i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: Add missing NULL check to _user_xsi_semget.

Browse Source 
Private semaphores will have a key of -1, but IPC_PRIVATE is 0,
meaning it is possible to wind up here and get a NULL semaphoreSet
if someone passes us an argument of -1.

Reported on Twitter.
This commit is contained in:
Augustin Cavalier
2019-02-18 23:24:28 -05:00
parent 1efb85decc
commit c62142a72b
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/kernel/posix/xsi_semaphore.cpp
+4 -4
View File
@@ -771,8 +771,8 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags)
MutexLocker _(sXsiSemaphoreSetLock); MutexLocker _(sXsiSemaphoreSetLock);
semaphoreSet = sSemaphoreHashTable.Lookup(semaphoreSetID); semaphoreSet = sSemaphoreHashTable.Lookup(semaphoreSetID);
if (!semaphoreSet->HasPermission()) { if (semaphoreSet == NULL || !semaphoreSet->HasPermission()) {
TRACE_ERROR(("xsi_semget: calling process has not permission " TRACE_ERROR(("xsi_semget: calling process has no permission "
"on semaphore %d, key %d\n", semaphoreSet->ID(), "on semaphore %d, key %d\n", semaphoreSet->ID(),
(int)key)); (int)key));
return EACCES; return EACCES;
@@ -815,9 +815,9 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags)
MutexLocker _(sXsiSemaphoreSetLock); MutexLocker _(sXsiSemaphoreSetLock);
semaphoreSet->SetID(); semaphoreSet->SetID();
if (isPrivate) if (isPrivate) {
semaphoreSet->SetIpcKey((key_t)-1); semaphoreSet->SetIpcKey((key_t)-1);
else { } else {
semaphoreSet->SetIpcKey(key); semaphoreSet->SetIpcKey(key);
ipcKey->SetSemaphoreSetID(semaphoreSet); ipcKey->SetSemaphoreSetID(semaphoreSet);
} }