Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

user_copy_strings_array() no longer puts 2k on the stack, but allocates a 16k

Browse Source 
buffer to allow safe access of the user provided string - maybe we should
introduce a user_strdup() instead.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@17960 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Axel Dörfler 2006-06-29 15:23:34 +00:00
parent 3bf5b314a9
commit 4e26bc08b8
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/system/kernel/team.c
View File

@ -10,7 +10,6 @@
#include <OS.h> #include <OS.h>
#include <defines.h>
#include <elf.h> #include <elf.h>
#include <file_cache.h> #include <file_cache.h>
#include <int.h> #include <int.h>
@ -298,7 +297,7 @@ error:
static status_t static status_t
user_copy_strings_array(char * const *userStrings, int32 count, char ***_strings) user_copy_strings_array(char * const *userStrings, int32 count, char ***_strings)
{ {
char buffer[SYS_THREAD_STRING_LENGTH_MAX]; char *buffer;
char **strings; char **strings;
status_t err; status_t err;
int32 i = 0; int32 i = 0;
@ -306,17 +305,25 @@ user_copy_strings_array(char * const *userStrings, int32 count, char ***_strings
if (!IS_USER_ADDRESS(userStrings)) if (!IS_USER_ADDRESS(userStrings))
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
strings = (char **)malloc((count + 1) * sizeof(char *)); // buffer for safely accessing the user string
if (strings == NULL) // TODO: maybe have a user_strdup() instead?
buffer = (char *)malloc(4 * B_PAGE_SIZE);
if (buffer == NULL)
return B_NO_MEMORY; return B_NO_MEMORY;
strings = (char **)malloc((count + 1) * sizeof(char *));
if (strings == NULL) {
err = B_NO_MEMORY;
goto error;
}
if ((err = user_memcpy(strings, userStrings, count * sizeof(char *))) < B_OK) if ((err = user_memcpy(strings, userStrings, count * sizeof(char *))) < B_OK)
goto error; goto error;
// scan all strings and copy to kernel space // scan all strings and copy to kernel space
for (; i < count; i++) { for (; i < count; i++) {
err = user_strlcpy(buffer, strings[i], SYS_THREAD_STRING_LENGTH_MAX); err = user_strlcpy(buffer, strings[i], 4 * B_PAGE_SIZE);
if (err < B_OK) if (err < B_OK)
goto error; goto error;
@ -329,11 +336,13 @@ user_copy_strings_array(char * const *userStrings, int32 count, char ***_strings
strings[count] = NULL; strings[count] = NULL;
*_strings = strings; *_strings = strings;
free(buffer);
return B_OK; return B_OK;
error: error:
free_strings_array(strings, i); free_strings_array(strings, i);
free(buffer);
TRACE(("user_copy_strings_array failed %ld\n", err)); TRACE(("user_copy_strings_array failed %ld\n", err));
return err; return err;