Skip to content

Commit

Permalink
[fs][shmfs]:Avoid an integer overflow
Browse files Browse the repository at this point in the history
[Desc]:We need to check the parameter passed to the kmm_zalloc(size_t) function.
If it exceeds the limit of size_t, we need to return an error directly to avoid further errors.

Signed-off-by: pengyinjie <[email protected]>
  • Loading branch information
XMPengYinjie authored and xiaoxiang781216 committed Aug 24, 2024
1 parent 634159a commit 77205b3
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion fs/shm/shmfs_alloc.c
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,15 @@ FAR struct shmfs_object_s *shmfs_alloc_object(size_t length)
* chunk in kernel heap
*/

object = kmm_zalloc(sizeof(struct shmfs_object_s) + length);
size_t alloc_size = sizeof(struct shmfs_object_s) + length;
if (alloc_size < length)
{
/* There must have been an integer overflow */

return NULL;
}

object = kmm_zalloc(alloc_size);
if (object)
{
object->paddr = (FAR char *)(object + 1);
Expand Down

0 comments on commit 77205b3

Please sign in to comment.