syscalls: fix unsafe userspace dereference in getpeername

This commit is contained in:
Matheus
2024-06-27 22:44:45 -03:00
parent 7821eb61c1
commit d8d39a288a
+15 -7
View File
@@ -1,11 +1,16 @@
#include <kernel/syscalls.h>
#include <kernel/sock.h>
syscallret_t syscall_getpeername(context_t *, int fd, void *uaddr, int *addrlen) {
syscallret_t syscall_getpeername(context_t *, int fd, void *uaddr, int *uaddrlen) {
syscallret_t ret = {
.ret = -1
};
int addrlen;
ret.errno = usercopy_fromuser(&addrlen, uaddrlen, sizeof(addrlen));
if (ret.errno)
return ret;
file_t *file = fd_get(fd);
if (file == NULL) {
ret.errno = EBADF;
@@ -27,15 +32,18 @@ syscallret_t syscall_getpeername(context_t *, int fd, void *uaddr, int *addrlen)
abisockaddr_t abisockaddr;
ret.errno = sock_addrtoabiaddr(socket->type, &sockaddr, &abisockaddr);
if (ret.errno)
goto cleanup;
ret.errno = usercopy_touser(uaddr, &abisockaddr, min(*addrlen, sizeof(abisockaddr_t)));
if (ret.errno)
goto cleanup;
*addrlen = sizeof(abisockaddr_t);
ret.ret = 0;
ret.errno = usercopy_touser(uaddr, &abisockaddr, min(addrlen, sizeof(abisockaddr_t)));
if (ret.errno)
goto cleanup;
addrlen = sizeof(abisockaddr_t);
ret.errno = usercopy_touser(uaddrlen, &addrlen, sizeof(addrlen));
ret.ret = ret.errno ? -1 : 0;
cleanup:
if (file)