Explorar el Código

[LibOS] Return EINVAL in mmap/munmap() for more cases

mmap/munmap() must return EINVAL if length is zero and if addr+length
leads to pointer arithmetic overflow. This commit adds correct checks.
Dmitrii Kuvaiskii hace 5 años
padre
commit
df5c84652b
Se han modificado 1 ficheros con 6 adiciones y 3 borrados
  1. 6 3
      LibOS/shim/src/sys/shim_mmap.c

+ 6 - 3
LibOS/shim/src/sys/shim_mmap.c

@@ -54,12 +54,12 @@ void * shim_do_mmap (void * addr, size_t length, int prot, int flags, int fd,
     if (fd >= 0 && !ALIGNED(offset))
         return (void *) -EINVAL;
 
+    if (!length || !access_ok(addr, length))
+        return (void*) -EINVAL;
+
     if (!ALIGNED(length))
         length = ALIGN_UP(length);
 
-    if (addr + length < addr)
-        return (void *) -EINVAL;
-
     /* ignore MAP_32BIT when MAP_FIXED is set */
     if ((flags & (MAP_32BIT|MAP_FIXED)) == (MAP_32BIT|MAP_FIXED))
         flags &= ~MAP_32BIT;
@@ -169,6 +169,9 @@ int shim_do_munmap (void * addr, size_t length)
     if (!addr || !ALIGNED(addr))
         return -EINVAL;
 
+    if (!length || !access_ok(addr, length))
+        return -EINVAL;
+
     if (!ALIGNED(length))
         length = ALIGN_UP(length);