From 0e4dc6af06228c8504a5538512cb31ed7bf6cc23 Mon Sep 17 00:00:00 2001 From: Zhihong Wang Date: Tue, 14 Dec 2021 11:30:16 +0800 Subject: [PATCH] ring: fix overflow in memory size calculation MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Parameters count and esize are both unsigned int, and their product can legaly exceed unsigned int and lead to runtime access violation. Fixes: cc4b218790f6 ("ring: support configurable element size") Cc: stable@dpdk.org Signed-off-by: Zhihong Wang Reviewed-by: Liang Ma Reviewed-by: Morten Brørup Acked-by: Konstantin Ananyev --- lib/ring/rte_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/ring/rte_ring.c b/lib/ring/rte_ring.c index 185f9be798..6a94a038c4 100644 --- a/lib/ring/rte_ring.c +++ b/lib/ring/rte_ring.c @@ -75,7 +75,7 @@ rte_ring_get_memsize_elem(unsigned int esize, unsigned int count) return -EINVAL; } - sz = sizeof(struct rte_ring) + count * esize; + sz = sizeof(struct rte_ring) + (ssize_t)count * esize; sz = RTE_ALIGN(sz, RTE_CACHE_LINE_SIZE); return sz; } -- 2.39.5