fluencelabs/musl
1
0
Fork 0
mirror of https://github.com/fluencelabs/musl synced 2025-07-01 23:52:02 +00:00
Code Issues Projects Releases Wiki Activity

work around wrong kernel type for sem_nsems member of struct semid_ds

Browse Source 
rejecting invalid values for n is fine even in the case where a new
sem will not be created, since the kernel does its range checks on n
even in this case as well.

by default, the kernel will bound the limit well below USHRT_MAX
anyway, but it's presumably possible that an administrator could
override this limit and break things.
This commit is contained in:
Rich Felker
2013-06-28 23:57:58 -04:00
parent 553d566c3f
commit 062f40ef3e
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
include/sys/sem.h
View File

@ -25,13 +25,21 @@ extern "C" {
#define SETVAL 16 #define SETVAL 16
#define SETALL 17 #define SETALL 17
#include <endian.h>
struct semid_ds { struct semid_ds {
struct ipc_perm sem_perm; struct ipc_perm sem_perm;
long sem_otime; long sem_otime;
unsigned long __unused1; unsigned long __unused1;
long sem_ctime; long sem_ctime;
unsigned long __unused2; unsigned long __unused2;
unsigned long sem_nsems; #if __BYTE_ORDER == __LITTLE_ENDIAN
unsigned short sem_nsems;
char __sem_nsems_pad[sizeof(long)-sizeof(short)];
#else
char __sem_nsems_pad[sizeof(long)-sizeof(short)];
unsigned short sem_nsems;
#endif
unsigned long __unused3; unsigned long __unused3;
unsigned long __unused4; unsigned long __unused4;
}; };

7
src/ipc/semget.c
View File

@ -1,9 +1,16 @@
#include <sys/sem.h> #include <sys/sem.h>
#include <limits.h>
#include <errno.h>
#include "syscall.h" #include "syscall.h"
#include "ipc.h" #include "ipc.h"
int semget(key_t key, int n, int fl) int semget(key_t key, int n, int fl)
{ {
/* The kernel uses the wrong type for the sem_nsems member
* of struct semid_ds, and thus might not check that the
* n fits in the correct (per POSIX) userspace type, so
* we have to check here. */
if (n > USHRT_MAX) return __syscall_ret(-EINVAL);
#ifdef SYS_semget #ifdef SYS_semget
return syscall(SYS_semget, key, n, fl); return syscall(SYS_semget, key, n, fl);
#else #else