Changeset 3ae470a in mainline

Timestamp:

2007-06-21T17:04:06Z (17 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

00acd66

Parents:

6765c07

Message:

Add sanity checks for reads and writes that occur past the end of the
ramdisk image.

File:

• uspace/rd/rd.c (modified) (5 diffs)

uspace/rd/rd.c

@@ -56 +56 @@
 /** Pointer to the ramdisk's image. */
 static void *rd_addr;
+/** Size of the ramdisk. */
+static size_t rd_size;
 
 /**
@@ -75 +77 @@
         ipc_call_t call;
         int retval;
-        uintptr_t fs_va = NULL;
+        void *fs_va = NULL;
         ipcarg_t offset;
 
@@ -140 +142 @@
                 case RD_READ_BLOCK:
                         offset = IPC_GET_ARG1(call);
+                        if (offset * BLOCK_SIZE > rd_size - BLOCK_SIZE) {
+                                /*
+                                 * Reading past the end of the device.
+                                 */
+                                retval = ELIMIT;
+                                break;
+                        }
                         futex_down(&rd_futex);
-                        memcpy((void *) fs_va, rd_addr + offset, BLOCK_SIZE);
+                        memcpy(fs_va, rd_addr + offset, BLOCK_SIZE);
                         futex_up(&rd_futex);
                         retval = EOK;
@@ -147 +156 @@
                 case RD_WRITE_BLOCK:
                         offset = IPC_GET_ARG1(call);
+                        if (offset * BLOCK_SIZE > rd_size - BLOCK_SIZE) {
+                                /*
+                                 * Writing past the end of the device.
+                                 */
+                                retval = ELIMIT;
+                                break;
+                        }
                         futex_up(&rd_futex);
-                        memcpy(rd_addr + offset, (void *) fs_va, BLOCK_SIZE);
+                        memcpy(rd_addr + offset, fs_va, BLOCK_SIZE);
                         futex_down(&rd_futex);
                         retval = EOK;
@@ -171 +187 @@
         int retval, flags;
 
-        size_t rd_size = sysinfo_value("rd.size");
+        rd_size = sysinfo_value("rd.size");
         void *rd_ph_addr = (void *) sysinfo_value("rd.address.physical");