On Mon, Apr 27, 2026 at 01:03:34PM +0100, Kevin Brodsky wrote: > get_header() wants the size of the reserved area in struct > sigcontext, but instead we pass it the size of the entire struct. > This could in theory result in an out-of-bounds read (if the signal > frame is malformed).
> Fix this using one of the existing macros from
> tools/testing/selftests/arm64/signal/testcases/testcases.h.
Oh, good to know this is peering inside the arm64 selftests - it'd be
good to document that on the arm64 side to avoid unpleasant suprirses.
> {
> struct _aarch64_ctx *ctx = GET_UC_RESV_HEAD(uctxt);
> + size_t resv_size = GET_UCP_RESV_SIZE(uctxt);
> struct poe_context *poe_ctx =
> (struct poe_context *) get_header(ctx, POE_MAGIC,
> - sizeof(uctxt->uc_mcontext),
> NULL);
> + resv_size, NULL);
Reviewed-by: Mark Brown <[email protected]>
signature.asc
Description: PGP signature
