lkml.org 
[lkml]   [2010]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] ipc: initialize structure memory to zero for shmctl
    The old shm interface will leak a few bytes of stack contents. Explicitly
    initialize the structure to zero-fill the untouched fields.

    Signed-off-by: Kees Cook <kees.cook@canonical.com>
    ---
    ipc/shm.c | 17 +++++++++--------
    1 files changed, 9 insertions(+), 8 deletions(-)

    diff --git a/ipc/shm.c b/ipc/shm.c
    index 52ed77e..d2ee426 100644
    --- a/ipc/shm.c
    +++ b/ipc/shm.c
    @@ -471,16 +471,17 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_
    return copy_to_user(buf, in, sizeof(*in));
    case IPC_OLD:
    {
    - struct shmid_ds out;
    + struct shmid_ds out = {
    + .shm_segsz = in->shm_segsz,
    + .shm_atime = in->shm_atime,
    + .shm_dtime = in->shm_dtime,
    + .shm_ctime = in->shm_ctime,
    + .shm_cpid = in->shm_cpid,
    + .shm_lpid = in->shm_lpid,
    + .shm_nattch = in->shm_nattch,
    + };

    ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
    - out.shm_segsz = in->shm_segsz;
    - out.shm_atime = in->shm_atime;
    - out.shm_dtime = in->shm_dtime;
    - out.shm_ctime = in->shm_ctime;
    - out.shm_cpid = in->shm_cpid;
    - out.shm_lpid = in->shm_lpid;
    - out.shm_nattch = in->shm_nattch;

    return copy_to_user(buf, &out, sizeof(out));
    }
    --
    1.7.1

    --
    Kees Cook
    Ubuntu Security Team


    \
     
     \ /
      Last update: 2010-10-07 02:13    [W:0.025 / U:0.384 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site