From 38138fab93584ad3560ddfcd70efbd5bb6b4a6f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Mon, 30 Jul 2018 14:43:20 +0100 Subject: [PATCH] linux-user/mmap.c: handle invalid len maps correctly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I've slightly re-organised the check to more closely match the sequence that the kernel uses in do_mmap(). We check for both the zero case (EINVAL) and the overflow length case (ENOMEM). Signed-off-by: Alex Bennée Cc: umarcor <1783362@bugs.launchpad.net> Reviewed-by: Laurent Vivier Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier --- linux-user/mmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index d0c50e4888..41e0983ce8 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -391,14 +391,23 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, } #endif + if (!len) { + errno = EINVAL; + goto fail; + } + + /* Also check for overflows... */ + len = TARGET_PAGE_ALIGN(len); + if (!len) { + errno = ENOMEM; + goto fail; + } + if (offset & ~TARGET_PAGE_MASK) { errno = EINVAL; goto fail; } - len = TARGET_PAGE_ALIGN(len); - if (len == 0) - goto the_end; real_start = start & qemu_host_page_mask; host_offset = offset & qemu_host_page_mask;