(nuttx) branch master updated: fs/tmpfs: fix an integer overflow

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new b2e6d7b9d7 fs/tmpfs: fix an integer overflow
b2e6d7b9d7 is described below

commit b2e6d7b9d70ce2f9e1f395d06f84a655f0ca5a54
Author: hujun5 <hu...@xiaomi.com>
AuthorDate: Tue Oct 24 14:12:36 2023 +0800

    fs/tmpfs: fix an integer overflow
    
    newsize = newsize + CONFIG_FS_TMPFS_FILE_ALLOCGUARD;
    
    When newsize is a large value,
    adding a relatively small value can cause the result to become very small,
    resulting in program logic errors.
    For example:
    0xffffffff + 0x2 = 1
    
    Signed-off-by: hujun5 <hu...@xiaomi.com>
---
 fs/tmpfs/fs_tmpfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/tmpfs/fs_tmpfs.c b/fs/tmpfs/fs_tmpfs.c
index 98995a39ba..01fae27f5a 100644
--- a/fs/tmpfs/fs_tmpfs.c
+++ b/fs/tmpfs/fs_tmpfs.c
@@ -298,6 +298,12 @@ static int tmpfs_realloc_file(FAR struct tmpfs_file_s *tfo,
    */
 
   allocsize = newsize + CONFIG_FS_TMPFS_FILE_ALLOCGUARD;
+  if (allocsize < newsize)
+    {
+      /* There must have been an integer overflow */
+
+      return -ENOMEM;
+    }
 
   /* Realloc the file object */