From 9eba220859d5f1a2ec39478e826c11befaf1b1dc Mon Sep 17 00:00:00 2001 From: Matheus Date: Mon, 17 Jun 2024 20:30:43 -0300 Subject: [PATCH] getsockname: fix unsafe pointer dereference --- kernel-src/sys/syscalls/getsockname.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/kernel-src/sys/syscalls/getsockname.c b/kernel-src/sys/syscalls/getsockname.c index 827a8cab..4d4e60c8 100644 --- a/kernel-src/sys/syscalls/getsockname.c +++ b/kernel-src/sys/syscalls/getsockname.c @@ -1,11 +1,18 @@ #include #include -syscallret_t syscall_getsockname(context_t *, int fd, void *uaddr, int *addrlen) { +syscallret_t syscall_getsockname(context_t *, int fd, void *uaddr, int *uaddrlen) { syscallret_t ret = { .ret = -1 }; + int addrlen; + ret.errno = usercopy_fromuser(&addrlen, uaddrlen, sizeof(addrlen)); + if (ret.errno) + return ret; + + addrlen = min(addrlen, sizeof(abisockaddr_t)); + file_t *file = fd_get(fd); if (file == NULL) { ret.errno = EBADF; @@ -30,11 +37,14 @@ syscallret_t syscall_getsockname(context_t *, int fd, void *uaddr, int *addrlen) if (ret.errno) goto cleanup; - ret.errno = usercopy_touser(uaddr, &abisockaddr, min(*addrlen, sizeof(abisockaddr_t))); + ret.errno = usercopy_touser(uaddr, &abisockaddr, addrlen); + if (ret.errno) + goto cleanup; + + ret.errno = usercopy_touser(uaddrlen, &addrlen, sizeof(addrlen)); if (ret.errno) goto cleanup; - *addrlen = sizeof(abisockaddr_t); ret.ret = 0; cleanup: