i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: image: _get_next_image_info shouldn't use a user buffer directly

Browse Source 
_user_get_next_image_info() now copies the cookie on the stack, calls
_get_next_image_info() and copy back the cookie to the user buffer.
This commit is contained in:
Jérôme Duval
2018-01-07 22:57:41 +01:00
parent 6e28d80927
commit ff678dd91b
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/system/kernel/image.cpp
+8 -3
View File
@@ -538,17 +538,22 @@ _user_get_next_image_info(team_id team, int32 *_cookie, image_info *userInfo,
{ {
image_info info; image_info info;
status_t status; status_t status;
int32 cookie;
if (size > sizeof(image_info)) if (size > sizeof(image_info))
return B_BAD_VALUE; return B_BAD_VALUE;
if (!IS_USER_ADDRESS(userInfo) || !IS_USER_ADDRESS(_cookie)) if (!IS_USER_ADDRESS(userInfo) || !IS_USER_ADDRESS(_cookie)
|| user_memcpy(&cookie, _cookie, sizeof(int32)) < B_OK) {
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
}
status = _get_next_image_info(team, _cookie, &info, sizeof(image_info)); status = _get_next_image_info(team, &cookie, &info, sizeof(image_info));
if (user_memcpy(userInfo, &info, size) < B_OK) if (user_memcpy(userInfo, &info, size) < B_OK
|| user_memcpy(_cookie, &cookie, sizeof(int32)) < B_OK) {
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
}
return status; return status;
} }