| From | Manfred Spraul <> | Subject | [PATCH 3/4] ipc/shm.c: check for integer overflow during shmget. | Date | Mon, 21 Apr 2014 16:26:36 +0200 |
| |
SHMMAX is the upper limit for the size of a shared memory segment, counted in bytes. The actual allocation is that size, rounded up to the next full page. Add a check that prevents the creation of segments where the rounded up size causes an integer overflow.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com> --- ipc/shm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/ipc/shm.c b/ipc/shm.c index 2dfa3d6..f000696 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,6 +493,9 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (size < SHMMIN || size > ns->shm_ctlmax) return -EINVAL; + if (numpages << PAGE_SHIFT < size) + return -ENOSPC; + if (ns->shm_tot + numpages < ns->shm_tot || ns->shm_tot + numpages > ns->shm_ctlall) return -ENOSPC; -- 1.9.0
|