ref: fdf21a19a5c6c75bcd66ee5ece4d4fd99b910105
parent: be766038eb87df8f0009daf96d91efec27b17cef
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Fri Feb 28 11:45:20 EST 2020
kernel: make sure we wont run into the tos when copying exec() arguments in case the calling process changes its arguments under us, it could happen that the final argument string lengths become bigger than initially calculated. this is fine as we still make sure we wont overflow the stack segment, but we could overrun into the tos structure at the end of the stack. so change the limit to the base of the tos, not the end of the stack segment.
--- a/sys/src/9/port/sysproc.c
+++ b/sys/src/9/port/sysproc.c
@@ -466,8 +466,10 @@
if(indir)
e = strchr(a, 0);
else {+ if(charp >= (char*)tos)
+ error(Ebadarg);
validaddr((uintptr)a, 1, 0);
- e = vmemchr(a, 0, (char*)tstk - charp);
+ e = vmemchr(a, 0, (char*)tos - charp);
if(e == nil)
error(Ebadarg);
}
--
⑨