Author: axeld Date: 2009-12-08 16:28:44 +0100 (Tue, 08 Dec 2009) New Revision: 34556 Changeset: http://dev.haiku-os.org/changeset/34556/haiku Modified: haiku/trunk/src/system/kernel/vm/vm.cpp Log: * Enforce that the caller of transfer_area() owns the area - this fixes some mean crashes with the media_server version I just checked in. Modified: haiku/trunk/src/system/kernel/vm/vm.cpp =================================================================== --- haiku/trunk/src/system/kernel/vm/vm.cpp 2009-12-08 14:55:14 UTC (rev 34555) +++ haiku/trunk/src/system/kernel/vm/vm.cpp 2009-12-08 15:28:44 UTC (rev 34556) @@ -4731,7 +4731,7 @@ /*! Transfers the specified area to a new team. The caller must be the owner - of the area (not yet enforced but probably should be). + of the area. */ area_id transfer_area(area_id id, void** _address, uint32 addressSpec, team_id target, @@ -4742,6 +4742,9 @@ if (status != B_OK) return status; + if (info.team != thread_get_current_thread()->team->id) + return B_PERMISSION_DENIED; + area_id clonedArea = vm_clone_area(target, info.name, _address, addressSpec, info.protection, REGION_NO_PRIVATE_MAP, id, kernel); if (clonedArea < 0)