From 126c0364bf7d72d4f2ecf1ad2f4ebe1d2667940d Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Sun, 1 Oct 2023 17:24:02 +0200 Subject: ipc: Fix allocating kernel buffer for storing user message Otherwise ipc_kmsg_copyin_body will overflow. --- ipc/ipc_kmsg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'ipc/ipc_kmsg.c') diff --git a/ipc/ipc_kmsg.c b/ipc/ipc_kmsg.c index bd1b30da..105e54d4 100644 --- a/ipc/ipc_kmsg.c +++ b/ipc/ipc_kmsg.c @@ -489,19 +489,20 @@ ipc_kmsg_get( ipc_kmsg_t *kmsgp) { ipc_kmsg_t kmsg; + mach_msg_size_t ksize = size * IKM_EXPAND_FACTOR; if ((size < sizeof(mach_msg_user_header_t)) || mach_msg_user_is_misaligned(size)) return MACH_SEND_MSG_TOO_SMALL; - if (size <= IKM_SAVED_MSG_SIZE) { + if (ksize <= IKM_SAVED_MSG_SIZE) { kmsg = ikm_cache_alloc(); if (kmsg == IKM_NULL) return MACH_SEND_NO_BUFFER; } else { - kmsg = ikm_alloc(size); + kmsg = ikm_alloc(ksize); if (kmsg == IKM_NULL) return MACH_SEND_NO_BUFFER; - ikm_init(kmsg, size); + ikm_init(kmsg, ksize); } if (copyinmsg(msg, &kmsg->ikm_header, size)) { -- cgit v1.2.3