mirror of
https://github.com/boykopovar/AnyPS5.git
synced 2026-11-03 12:57:27 +00:00
fstat, _fstat, sceKernelFstat, stat, lstat, sceKernelStat and _fstatfs filled the caller's struct in place, or copied into it after a check that only tests for null, so a pointer into unmapped memory crashed the host. Fill a local struct and copy it out with a checked write that fails with EFAULT. FreeBSD 11.4 does the same after the lookup has succeeded: copyout(&ub, uap->sb) in sys_fstat (sys/kern/kern_descrip.c:1328), copyout(&sb, uap->ub) in sys_stat (sys/kern/vfs_syscalls.c:2066) and copyout(sfp, uap->buf) in sys_fstatfs (sys/kern/vfs_syscalls.c:337). Co-Authored-By: Claude Sonnet 5.5 <[email protected]>