From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:48139) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SUdyE-0006hg-OC for qemu-devel@nongnu.org; Wed, 16 May 2012 09:08:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SUdyD-0003cK-2m for qemu-devel@nongnu.org; Wed, 16 May 2012 09:08:50 -0400 Received: from mx.meyering.net ([88.168.87.75]:35765 helo=hx.meyering.net) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SUdyC-0003be-O4 for qemu-devel@nongnu.org; Wed, 16 May 2012 09:08:49 -0400 From: Jim Meyering Date: Wed, 16 May 2012 15:08:00 +0200 Message-Id: <1337173681-25891-6-git-send-email-jim@meyering.net> In-Reply-To: <1337173681-25891-1-git-send-email-jim@meyering.net> References: <1337173681-25891-1-git-send-email-jim@meyering.net> Subject: [Qemu-devel] [PATCH 5/6] arm-semi: don't leak 1kb user string lock buffer upon TARGET_SYS_OPEN List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Anthony Liguori , Jim Meyering , Stefan Weil , Riku Voipio , =?UTF-8?q?C=C3=A9dric=20VINCENT?= From: Jim Meyering Always call unlock_user before returning. . Signed-off-by: Jim Meyering --- arm-semi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/arm-semi.c b/arm-semi.c index 88ca9bb..5d2a2d2 100644 --- a/arm-semi.c +++ b/arm-semi.c @@ -194,18 +194,19 @@ uint32_t do_arm_semihosting(CPUARMState *env) if (!(s = lock_user_string(ARG(0)))) /* FIXME - should this error code be -TARGET_EFAULT ? */ return (uint32_t)-1; - if (ARG(1) >= 12) + if (ARG(1) >= 12) { + unlock_user(s, ARG(0), 0); return (uint32_t)-1; + } if (strcmp(s, ":tt") == 0) { - if (ARG(1) < 4) - return STDIN_FILENO; - else - return STDOUT_FILENO; + int result_fileno = ARG(1) < 4 ? STDIN_FILENO : STDOUT_FILENO; + unlock_user(s, ARG(0), 0); + return result_fileno; } if (use_gdb_syscalls()) { gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0), (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]); - return env->regs[0]; + ret = env->regs[0]; } else { ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644)); } -- 1.7.10.2.520.g6a4a482