Mesa (master): os/os_memory_aligned.h: Handle integer overflow.
Jose Fonseca
jrfonseca at kemper.freedesktop.org
Thu Apr 23 21:03:00 UTC 2015
Module: Mesa
Branch: master
Commit: 525be9c0791e4a447335307b5f225273b9da0cca
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=525be9c0791e4a447335307b5f225273b9da0cca
Author: Jose Fonseca <jfonseca at vmware.com>
Date: Wed Apr 22 20:23:59 2015 +0100
os/os_memory_aligned.h: Handle integer overflow.
This code is only used when our memory debugging wrappers are enabled,
as we use the C runtime functions directly elsewhere.
Tested llvmpipe on Windows w/ memory debugging enabled.
VMware PR894263.
Reviewed-by: Roland Scheidegger <sroland at vmware.com>
---
src/gallium/auxiliary/os/os_memory_aligned.h | 28 +++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/src/gallium/auxiliary/os/os_memory_aligned.h b/src/gallium/auxiliary/os/os_memory_aligned.h
index 72c5cf6..bb15f24 100644
--- a/src/gallium/auxiliary/os/os_memory_aligned.h
+++ b/src/gallium/auxiliary/os/os_memory_aligned.h
@@ -39,6 +39,19 @@
#include "pipe/p_compiler.h"
+
+/**
+ * Add two size_t values with integer overflow check.
+ * TODO: leverage __builtin_add_overflow where available
+ */
+static inline bool
+add_overflow_size_t(size_t a, size_t b, size_t *res)
+{
+ *res = a + b;
+ return *res < a || *res < b;
+}
+
+
/**
* Return memory on given byte alignment
*/
@@ -46,8 +59,21 @@ static INLINE void *
os_malloc_aligned(size_t size, size_t alignment)
{
char *ptr, *buf;
+ size_t alloc_size;
+
+ /*
+ * Calculate
+ *
+ * alloc_size = size + alignment + sizeof(void *)
+ *
+ * while checking for overflow.
+ */
+ if (add_overflow_size_t(size, alignment, &alloc_size) ||
+ add_overflow_size_t(alloc_size, sizeof(void *), &alloc_size)) {
+ return NULL;
+ }
- ptr = (char *) os_malloc(size + alignment + sizeof(void *));
+ ptr = (char *) os_malloc(alloc_size);
if (!ptr)
return NULL;
More information about the mesa-commit
mailing list