Kernel: Pointer range validation should fail on wraparound

Let's reject address ranges that wrap around the 2^32 mark.
akimdi · Dec 31, 2019 · 36f1de3 · 36f1de3
1 parent 903b159
commit 36f1de3
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/Kernel/Process.cpp b/Kernel/Process.cpp
@@ -1971,6 +1971,8 @@ bool Process::validate_read(const void* address, ssize_t size) const
  ASSERT(size >= 0);
  VirtualAddress first_address((u32)address);
  VirtualAddress last_address = first_address.offset(size - 1);
+ if (last_address < first_address)
+ return false;
  if (is_ring0()) {
  auto kmc_result = check_kernel_memory_access(first_address, false);
  if (kmc_result == KernelMemoryCheckResult::AccessGranted)
@@ -1995,6 +1997,8 @@ bool Process::validate_write(void* address, ssize_t size) const
  ASSERT(size >= 0);
  VirtualAddress first_address((u32)address);
  VirtualAddress last_address = first_address.offset(size - 1);
+ if (last_address < first_address)
+ return false;
  if (is_ring0()) {
  if (is_kmalloc_address(address))
  return true;