[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG
From: |
Stephen Long |
Subject: |
[PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG |
Date: |
Thu, 7 May 2020 06:03:02 -0700 |
The bug was triggered by the following code on aarch64-linux-user:
#include <signal.h>
#include <sys/prctl.h>
int main(void)
{
int PDeathSig = 0;
if (prctl(PR_GET_PDEATHSIG, &PDeathSig) == 0 && PDeathSig == SIGKILL)
prctl(PR_GET_PDEATHSIG, 0);
return (PDeathSig == SIGKILL);
}
Signed-off-by: Stephen Long <address@hidden>
Signed-off-by: Ana Pazos <address@hidden>
---
I fixed the incorrect subject line. PR_GETDEATHSIG should be PR_GET_PDEATHSIG.
Is there a test folder where I can include the code that triggered the bug?
Also, I thought "int" can be 2 bytes on some machines.
linux-user/syscall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 05f03919ff..91f91147ba 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -10256,7 +10256,7 @@ static abi_long do_syscall1(void *cpu_env, int num,
abi_long arg1,
int deathsig;
ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
if (!is_error(ret) && arg2
- && put_user_ual(deathsig, arg2)) {
+ && put_user_s32(deathsig, arg2)) {
return -TARGET_EFAULT;
}
return ret;
--
2.17.1
- [PATCH v2] Fix stack smashing when handling PR_GET_PDEATHSIG,
Stephen Long <=