Module Name: src Committed By: snj Date: Fri Aug 18 14:52:43 UTC 2017
Modified Files: src/sys/kern [netbsd-6-1]: kern_malloc.c Log Message: Pull up following revision(s) (requested by martin in ticket #1465): sys/kern/kern_malloc.c: revision 1.146 Avoid integer overflow in kern_malloc(). Reported by Ilja Van Sprundel. To generate a diff of this commit: cvs rdiff -u -r1.138 -r1.138.8.1 src/sys/kern/kern_malloc.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/kern/kern_malloc.c diff -u src/sys/kern/kern_malloc.c:1.138 src/sys/kern/kern_malloc.c:1.138.8.1 --- src/sys/kern/kern_malloc.c:1.138 Mon Feb 6 12:13:44 2012 +++ src/sys/kern/kern_malloc.c Fri Aug 18 14:52:43 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: kern_malloc.c,v 1.138 2012/02/06 12:13:44 drochner Exp $ */ +/* $NetBSD: kern_malloc.c,v 1.138.8.1 2017/08/18 14:52:43 snj Exp $ */ /* * Copyright (c) 1987, 1991, 1993 @@ -66,7 +66,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: kern_malloc.c,v 1.138 2012/02/06 12:13:44 drochner Exp $"); +__KERNEL_RCSID(0, "$NetBSD: kern_malloc.c,v 1.138.8.1 2017/08/18 14:52:43 snj Exp $"); #include <sys/param.h> #include <sys/proc.h> @@ -113,7 +113,10 @@ kern_malloc(unsigned long size, struct m void *p; if (size >= PAGE_SIZE) { - allocsize = PAGE_SIZE + size; /* for page alignment */ + if (size > (ULONG_MAX-PAGE_SIZE)) + allocsize = ULONG_MAX; /* this will fail later */ + else + allocsize = PAGE_SIZE + size; /* for page alignment */ hdroffset = PAGE_SIZE - sizeof(struct malloc_header); } else { allocsize = sizeof(struct malloc_header) + size;