shithub: riscv

Download patch

ref: adb36de077c9bcd99072e86c7f84bac46a58e326
parent: ff3e0eeb22816208360db3c87e501c5de7d998e3
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Fri Feb 28 11:45:20 EST 2020

kernel: make sure we wont run into the tos when copying exec() arguments

in case the calling process changes its arguments under us, it could
happen that the final argument string lengths become bigger than
initially calculated. this is fine as we still make sure we wont
overflow the stack segment, but we could overrun into the tos
structure at the end of the stack. so change the limit to the
base of the tos, not the end of the stack segment.

--- a/sys/src/9/port/sysproc.c

+++ b/sys/src/9/port/sysproc.c

@@ -466,8 +466,10 @@

 		if(indir)

 			e = strchr(a, 0);

 		else {

+			if(charp >= (char*)tos)

+				error(Ebadarg);

 			validaddr((uintptr)a, 1, 0);

-			e = vmemchr(a, 0, (char*)tstk - charp);

+			e = vmemchr(a, 0, (char*)tos - charp);

 			if(e == nil)

 				error(Ebadarg);

 		}