XenOn/kolibrios-fun
1
1
Fork 0
forked from KolibriOS/kolibrios
Code Pull Requests Wiki Activity

fixed vulnerability (reading kernel memory from userspace) in sysfn25

Browse Source 
git-svn-id: svn://kolibrios.org@8675 a494cfbc-eb01-0410-851d-a64ba20cac60
This commit is contained in:
Rustem Gimadutdinov (rgimad) 2021-04-22 19:59:52 +00:00
parent 994d28964c
commit c7a8498e42
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel/trunk/kernel.asm
View File

@ -5420,6 +5420,14 @@ syscall_putarea_backgr:
mov esi, ecx mov esi, ecx
; ecx - size x, edx - size y ; ecx - size x, edx - size y
mov ebp, edx mov ebp, edx
lea ebp, [ebp*4]
imul ebp, esi
stdcall is_region_userspace, edi, ebp
jz .exit
mov ebp, edx
dec ebp dec ebp
shl ebp, 2 shl ebp, 2
@ -5477,6 +5485,7 @@ align 4
dec edx dec edx
jnz .start_y jnz .start_y
.exit:
popad popad
ret ret
;----------------------------------------------------------------------------- ;-----------------------------------------------------------------------------