From ff678dd91b75220f47651765b68ff91bffd25f50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Sun, 7 Jan 2018 22:54:24 +0100 Subject: [PATCH] kernel: image: _get_next_image_info shouldn't use a user buffer directly _user_get_next_image_info() now copies the cookie on the stack, calls _get_next_image_info() and copy back the cookie to the user buffer. --- src/system/kernel/image.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/system/kernel/image.cpp b/src/system/kernel/image.cpp index 31fe3088fc..30c4b293b0 100644 --- a/src/system/kernel/image.cpp +++ b/src/system/kernel/image.cpp @@ -538,17 +538,22 @@ _user_get_next_image_info(team_id team, int32 *_cookie, image_info *userInfo, { image_info info; status_t status; + int32 cookie; if (size > sizeof(image_info)) return B_BAD_VALUE; - if (!IS_USER_ADDRESS(userInfo) || !IS_USER_ADDRESS(_cookie)) + if (!IS_USER_ADDRESS(userInfo) || !IS_USER_ADDRESS(_cookie) + || user_memcpy(&cookie, _cookie, sizeof(int32)) < B_OK) { return B_BAD_ADDRESS; + } - status = _get_next_image_info(team, _cookie, &info, sizeof(image_info)); + status = _get_next_image_info(team, &cookie, &info, sizeof(image_info)); - if (user_memcpy(userInfo, &info, size) < B_OK) + if (user_memcpy(userInfo, &info, size) < B_OK + || user_memcpy(_cookie, &cookie, sizeof(int32)) < B_OK) { return B_BAD_ADDRESS; + } return status; }