Skip to content

Misuse of task_info API may cause crashes #25243

@avivkiss

Description

@avivkiss

Re the use of task_info @

mach_msg_type_number_t size = sizeof(info);

The task_info API requires an in-out task_info_count parameter containing the maximum number of ints which can be stored in the task_info parameter. The current code is passing in the size in bytes which could cause Here’s a snippet from the GNU docs:

“The function task_info returns the selected information array for a task, as specified by flavor. task_info is an array of integers that is supplied by the caller, and filled with specified information. task_info_count is supplied as the maximum number of integers in task_info. On return, it contains the actual number of integers in task_info. The maximum number of integers returned by any flavor is TASK_INFO_MAX.”

The fix is to either divide by sizeof(natural_t) or to use the standard TASK_BASIC_INFO_COUNT

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugRan CommandsOne of our bots successfully processed a command.StaleThere has been a lack of activity on this issue and it may be closed soon.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions