Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kernel: Add missing NULL check to _user_xsi_semget.

Browse Source 
Private semaphores will have a key of -1, but IPC_PRIVATE is 0,
meaning it is possible to wind up here and get a NULL semaphoreSet
if someone passes us an argument of -1.

Reported on Twitter.
This commit is contained in:
Augustin Cavalier 2019-02-18 22:58:22 -05:00
parent 1efb85decc
commit c62142a72b
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/system/kernel/posix/xsi_semaphore.cpp
View File

@ -771,8 +771,8 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags)
MutexLocker _(sXsiSemaphoreSetLock);
semaphoreSet = sSemaphoreHashTable.Lookup(semaphoreSetID);
if (!semaphoreSet->HasPermission()) {
TRACE_ERROR(("xsi_semget: calling process has not permission "
if (semaphoreSet == NULL || !semaphoreSet->HasPermission()) {
TRACE_ERROR(("xsi_semget: calling process has no permission "
"on semaphore %d, key %d\n", semaphoreSet->ID(),
(int)key));
return EACCES;
@ -815,9 +815,9 @@ _user_xsi_semget(key_t key, int numberOfSemaphores, int flags)
MutexLocker _(sXsiSemaphoreSetLock);
semaphoreSet->SetID();
if (isPrivate)
if (isPrivate) {
semaphoreSet->SetIpcKey((key_t)-1);
else {
} else {
semaphoreSet->SetIpcKey(key);
ipcKey->SetSemaphoreSetID(semaphoreSet);
}