XenOn/kolibrios-fun
1
1
Fork 0
forked from KolibriOS/kolibrios
Code Pull Requests Wiki Activity

added is_region_userspace, fix sysfn 26.2 address security checks

Browse Source 
git-svn-id: svn://kolibrios.org@8160 a494cfbc-eb01-0410-851d-a64ba20cac60
This commit is contained in:
Rustem Gimadutdinov (rgimad) 2020-11-07 16:42:34 +00:00
parent 147e8fa432
commit 9508cfa2b7
1 changed files with 41 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
kernel/trunk/kernel.asm
View File

@ -1746,8 +1746,14 @@ sys_getsetup:
dec ecx dec ecx
jnz .shift jnz .shift
cmp ebx, 0x7FFFFFFF ; if given memory address belongs to kernel then error ; if given memory address belongs to kernel then error
ja .addr_error push ebx
mov eax, ebx
mov ebx, 128
call is_region_userspace
pop ebx
test eax, eax
jz .addr_error
mov eax, keymap mov eax, keymap
mov ecx, 128 mov ecx, 128
@ -1759,8 +1765,13 @@ sys_getsetup:
dec ecx dec ecx
jnz .alt jnz .alt
cmp ebx, 0x7FFFFFFF push ebx
ja .addr_error mov eax, ebx
mov ebx, 128
call is_region_userspace
pop ebx
test eax, eax
jz .addr_error
mov eax, keymap_shift mov eax, keymap_shift
mov ecx, 128 mov ecx, 128
@ -1772,8 +1783,13 @@ sys_getsetup:
dec ecx dec ecx
jne .country jne .country
cmp ebx, 0x7FFFFFFF push ebx
ja .addr_error mov eax, ebx
mov ebx, 128
call is_region_userspace
pop ebx
test eax, eax
jz .addr_error
mov eax, keymap_alt mov eax, keymap_alt
mov ecx, 128 mov ecx, 128
@ -5647,11 +5663,29 @@ sys_apm:
; ----------------------------------------- ; -----------------------------------------
align 4 align 4
undefined_syscall: ; Undefined system call undefined_syscall: ; Undefined system call
mov [esp + 32], dword -1 mov [esp + 32], dword -1
ret ret
align 4
; check if given memory region lays in lower 2gb (userspace memory) or not
is_region_userspace:
; in: eax = base
; ebx = len
; out: eax = 1 if region in userspace memory, 0 if not
push esi edi ecx
add eax, ebx
cmp eax, OS_BASE
ja @f
mov eax, 1
jmp .ret
@@:
xor eax, eax
.ret:
pop ecx edi esi
ret
if ~ lang eq sp if ~ lang eq sp
diff16 "end of .text segment",0,$ diff16 "end of .text segment",0,$