asynts 0579a2db34 Kernel: Fix kernel crash in get_dir_entries when buffer too small. ...

Before e06362de9487806df92cf2360a42d3eed905b6bf this was a sneaky buffer
overflow. BufferStream did not do range checking and continued to write
past the allocated buffer (the size of which was controlled by the
user.)

The issue surfaced after my changes because OutputMemoryStream does
range checking.

Not sure how exploitable that bug was, directory entries are somewhat
controllable by the user but the buffer was on the heap, so exploiting
that should be tough.

2020-09-16 17:10:04 +02:00

8.9 KiB

Raw Blame History

View Raw