diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2022-03-02 22:03:26 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2022-03-03 22:48:43 +0100 |
| commit | 1a823cdeb9faea3849843e0b3dae0fbdd607e8b7 (patch) | |
| tree | e7e6f91ec7e59db9d0b07edcb5d3d3c98ca21420 /src/libsystemd/sd-hwdb | |
| parent | 94ce42bcb6288583bfa8995aa705d99a9221f47e (diff) | |
| download | systemd-1a823cdeb9faea3849843e0b3dae0fbdd607e8b7.tar.gz | |
core: check size before mmap
The data type off_t can be 64 on 32 bit systems if they have large
file support. Since mmap expects a size_t with 32 bits as second
argument truncation could occur. At worst these huge files could
lead to mmaps smaller than the previous check for small files.
This in turn shouldn't have a lot of impact because mmap allocates
at page size boundaries. This also made the PAGE_ALIGN call in
open_mmap unneeded. In fact it was neither in sync with other mmap
calls nor with its own munmap counterpart in error path.
If such large files are encountered, which is very unlikely in these
code paths, treat them with the same error as if they are too small.
Diffstat (limited to 'src/libsystemd/sd-hwdb')
| -rw-r--r-- | src/libsystemd/sd-hwdb/sd-hwdb.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c index 53601765fe..748cf26934 100644 --- a/src/libsystemd/sd-hwdb/sd-hwdb.c +++ b/src/libsystemd/sd-hwdb/sd-hwdb.c @@ -15,6 +15,7 @@ #include "alloc-util.h" #include "fd-util.h" +#include "fileio.h" #include "hashmap.h" #include "hwdb-internal.h" #include "nulstr-util.h" @@ -312,6 +313,9 @@ _public_ int sd_hwdb_new(sd_hwdb **ret) { if (hwdb->st.st_size < (off_t) offsetof(struct trie_header_f, strings_len) + 8) return log_debug_errno(SYNTHETIC_ERRNO(EIO), "File %s is too short: %m", hwdb_bin_path); + if (file_offset_beyond_memory_size(hwdb->st.st_size)) + return log_debug_errno(SYNTHETIC_ERRNO(EFBIG), + "File %s is too long: %m", hwdb_bin_path); hwdb->map = mmap(0, hwdb->st.st_size, PROT_READ, MAP_SHARED, fileno(hwdb->f), 0); if (hwdb->map == MAP_FAILED) |