X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/6d2010ae8f7a6078e10b361c6962983bab233e0f..d26ffc64f583ab2d29df48f13518685602bc8832:/osfmk/i386/user_ldt.c

diff --git a/osfmk/i386/user_ldt.c b/osfmk/i386/user_ldt.c
index 8b5791455..35dd2cef7 100644
--- a/osfmk/i386/user_ldt.c
+++ b/osfmk/i386/user_ldt.c
@@ -224,7 +224,6 @@ i386_set_ldt(
 	    } else {
 		bzero(&new_ldt->ldt[start_sel - begin_sel], num_sels * sizeof(struct real_descriptor));
 	    }
-
 	    /*
 	     * Validate descriptors.
 	     * Only allow descriptors with user privileges.
@@ -253,6 +252,12 @@ i386_set_ldt(
 			user_ldt_free(new_ldt);
 			return EACCES;
 		}
+		/* Reject attempts to create segments with 64-bit granules */
+		if (dp->granularity & SZ_64) {
+			task_unlock(task);
+			user_ldt_free(new_ldt);
+			return EACCES;
+		}
 	    }
 	}
 
@@ -292,9 +297,9 @@ i386_get_ldt(
 	unsigned int	ldt_count;
 	kern_return_t	err;
 
-	if (start_sel >= 8192)
+	if (start_sel >= LDTSZ)
 	    return EINVAL;
-	if ((uint64_t)start_sel + (uint64_t)num_sels > 8192)
+	if ((uint64_t)start_sel + (uint64_t)num_sels > LDTSZ)
 	    return EINVAL;
 	if (descs == 0)
 	    return EINVAL;