Gaurav Aggarwal 7a98bd8d78 Added checks for xIndex in ThreadLocalStorage APIs ...

It was possible for a third party that already independently gained the
ability to execute injected code to read from or write to arbitrary
addresses by passing a negative argument as the xIndex parameter to
pvTaskGetThreadLocalStoragePointer() or
vTaskSetThreadLocalStoragePointer respectively.

This commit adds checks to ensure that passing a negative argument as
the xIndex parameter does not cause arbitrary read or write.

We thank Certibit Consulting, LLC for reporting this issue.

Signed-off-by: Gaurav Aggarwal <aggarg@amazon.com>

2022-09-16 22:18:35 +05:30

221 KiB

Raw Blame History

View Raw