PR11112: Check the full %m/M buffer, and limit the length

We already had code in place to try a deref on the requested memory
buffer, but it was missing the static-precision case.  Thus, it was
possible to craft an address that would pass the check on the first byte
but would pagefault at the end of the buffer.

While we're at it, we should also be limiting the number of bytes in
such a read, so even legitimately-huge buffers won't chew up kernel
time.  I've arbitrarily chosen 1024 as the limit, but we can revisit
that later. (see also PR10490)

TODO: we need a reliable testcase where a starting address is valid but
the end address is bogus.  In PR11112, the reproducer was using a huge
precision to run off the heap, but we need something that will
consistently work even with <1024 length.

0 files changed, 0 insertions, 0 deletions