From 91fe57ac0010324510d9e6532daf79b5bc50ed6c Mon Sep 17 00:00:00 2001 From: Anatoly Burakov Date: Mon, 30 Apr 2018 12:21:42 +0100 Subject: [PATCH] mem: check if allocation size is too big Mapping size is a 64-bit integer, but mmap() will accept size_t for size mappings. A user could request a mapping with an alignment, which would have overflown size_t, so check if (size + alignment) will overflow size_t. Signed-off-by: Anatoly Burakov Acked-by: Bruce Richardson --- lib/librte_eal/common/eal_common_memory.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/librte_eal/common/eal_common_memory.c b/lib/librte_eal/common/eal_common_memory.c index f080132466..5611a5176d 100644 --- a/lib/librte_eal/common/eal_common_memory.c +++ b/lib/librte_eal/common/eal_common_memory.c @@ -75,8 +75,13 @@ eal_get_virtual_area(void *requested_addr, size_t *size, do { map_sz = no_align ? *size : *size + page_sz; + if (map_sz > SIZE_MAX) { + RTE_LOG(ERR, EAL, "Map size too big\n"); + rte_errno = E2BIG; + return NULL; + } - mapped_addr = mmap(requested_addr, map_sz, PROT_READ, + mapped_addr = mmap(requested_addr, (size_t)map_sz, PROT_READ, mmap_flags, -1, 0); if (mapped_addr == MAP_FAILED && allow_shrink) *size -= page_sz; -- 2.20.1