mirror of
https://github.com/RT-Thread/rt-thread.git
synced 2026-08-18 00:39:22 +08:00
yi chen
4fbdf331d1
sys_select() passed the raw user-space timeout pointer straight through to select(), unlike readfds/writefds/exceptfds which are all validated with lwp_user_accessable() and copied into kernel memory first. A malicious or buggy user thread could pass a timeout pointing at unmapped or otherwise invalid memory, which select() would then dereference directly (timeout->tv_sec / timeout->tv_usec) without any check, from kernel context. Validate and copy it into a kernel-local struct timeval the same way the fd_set arguments already are, before it reaches select(). Fixes #10298 Signed-off-by: yi chen <94xhn1@gmail.com>