Messages in this thread Patch in this message | | | Date | Wed, 6 Oct 2010 17:10:31 -0700 | From | Kees Cook <> | Subject | [PATCH] ipc: initialize structure memory to zero for shmctl |
| |
The old shm interface will leak a few bytes of stack contents. Explicitly initialize the structure to zero-fill the untouched fields.
Signed-off-by: Kees Cook <kees.cook@canonical.com> --- ipc/shm.c | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/ipc/shm.c b/ipc/shm.c index 52ed77e..d2ee426 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -471,16 +471,17 @@ static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ return copy_to_user(buf, in, sizeof(*in)); case IPC_OLD: { - struct shmid_ds out; + struct shmid_ds out = { + .shm_segsz = in->shm_segsz, + .shm_atime = in->shm_atime, + .shm_dtime = in->shm_dtime, + .shm_ctime = in->shm_ctime, + .shm_cpid = in->shm_cpid, + .shm_lpid = in->shm_lpid, + .shm_nattch = in->shm_nattch, + }; ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm); - out.shm_segsz = in->shm_segsz; - out.shm_atime = in->shm_atime; - out.shm_dtime = in->shm_dtime; - out.shm_ctime = in->shm_ctime; - out.shm_cpid = in->shm_cpid; - out.shm_lpid = in->shm_lpid; - out.shm_nattch = in->shm_nattch; return copy_to_user(buf, &out, sizeof(out)); } -- 1.7.1
-- Kees Cook Ubuntu Security Team
| |