mem: check if allocation size is too big
authorAnatoly Burakov <anatoly.burakov@intel.com>
Mon, 30 Apr 2018 11:21:42 +0000 (12:21 +0100)
committerThomas Monjalon <thomas@monjalon.net>
Sun, 13 May 2018 23:32:21 +0000 (01:32 +0200)
Mapping size is a 64-bit integer, but mmap() will accept size_t for
size mappings. A user could request a mapping with an alignment, which
would have overflown size_t, so check if (size + alignment) will
overflow size_t.

Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
lib/librte_eal/common/eal_common_memory.c

index f080132..5611a51 100644 (file)
@@ -75,8 +75,13 @@ eal_get_virtual_area(void *requested_addr, size_t *size,
 
        do {
                map_sz = no_align ? *size : *size + page_sz;
+               if (map_sz > SIZE_MAX) {
+                       RTE_LOG(ERR, EAL, "Map size too big\n");
+                       rte_errno = E2BIG;
+                       return NULL;
+               }
 
-               mapped_addr = mmap(requested_addr, map_sz, PROT_READ,
+               mapped_addr = mmap(requested_addr, (size_t)map_sz, PROT_READ,
                                mmap_flags, -1, 0);
                if (mapped_addr == MAP_FAILED && allow_shrink)
                        *size -= page_sz;