Skip to content

Commit 66c2df7

Browse files
committed
Fix integer overflows
1 parent 34d38ee commit 66c2df7

File tree

3 files changed

+37
-3
lines changed

3 files changed

+37
-3
lines changed

src/base_alloc/base_alloc_global.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,19 @@ void *umf_ba_global_aligned_alloc(size_t size, size_t alignment) {
155155
return NULL;
156156
}
157157

158+
if (SIZE_MAX - size < ALLOC_METADATA_SIZE) {
159+
LOG_ERR("base_alloc: allocation size (%zu) too large.", size);
160+
return NULL;
161+
}
162+
158163
// for metadata
159164
size += ALLOC_METADATA_SIZE;
160165

161166
if (alignment > ALLOC_METADATA_SIZE) {
167+
if (SIZE_MAX - size < alignment) {
168+
LOG_ERR("base_alloc: allocation size (%zu) too large.", size);
169+
return NULL;
170+
}
162171
size += alignment;
163172
}
164173

src/provider/provider_os_memory.c

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,22 @@ validatePartitions(umf_os_memory_provider_params_t *params) {
360360
return UMF_RESULT_SUCCESS;
361361
}
362362

363+
static umf_result_t os_get_min_page_size(void *provider, void *ptr,
364+
size_t *page_size);
365+
366+
static umf_result_t validatePartSize(os_memory_provider_t *provider,
367+
umf_os_memory_provider_params_t *params) {
368+
size_t page_size;
369+
os_get_min_page_size(provider, NULL, &page_size);
370+
if (ALIGN_UP(params->part_size, page_size) < params->part_size) {
371+
LOG_ERR("partition size (%zu) is too big, cannot align with a page "
372+
"size (%zu)",
373+
params->part_size, page_size);
374+
return UMF_RESULT_ERROR_INVALID_ARGUMENT;
375+
}
376+
return UMF_RESULT_SUCCESS;
377+
}
378+
363379
static void free_bitmaps(os_memory_provider_t *provider) {
364380
for (unsigned i = 0; i < provider->nodeset_len; i++) {
365381
hwloc_bitmap_free(provider->nodeset[i]);
@@ -443,6 +459,14 @@ static umf_result_t translate_params(umf_os_memory_provider_params_t *in_params,
443459
return result;
444460
}
445461

462+
if (in_params->numa_mode == UMF_NUMA_MODE_INTERLEAVE) {
463+
result = validatePartSize(provider, in_params);
464+
if (result != UMF_RESULT_SUCCESS) {
465+
LOG_ERR("incorrect partition size: %zu", in_params->part_size);
466+
return result;
467+
}
468+
}
469+
446470
int is_dedicated_node_bind = dedicated_node_bind(in_params);
447471
provider->numa_policy =
448472
translate_numa_mode(in_params->numa_mode, is_dedicated_node_bind);
@@ -578,9 +602,6 @@ static void os_finalize(void *provider) {
578602
umf_ba_global_free(os_provider);
579603
}
580604

581-
static umf_result_t os_get_min_page_size(void *provider, void *ptr,
582-
size_t *page_size);
583-
584605
// TODO: this function should be reenabled when CTL is implemented
585606
#if 0
586607
static void print_numa_nodes(os_memory_provider_t *os_provider, void *addr,

test/common/provider.hpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,10 @@ struct provider_malloc : public provider_base_t {
106106
align = 8;
107107
}
108108

109+
if (SIZE_MAX - size < align) {
110+
return UMF_RESULT_ERROR_OUT_OF_HOST_MEMORY;
111+
}
112+
109113
// aligned_malloc returns a valid pointer despite not meeting the
110114
// requirement of 'size' being multiple of 'align' even though the
111115
// documentation says that it has to. AddressSanitizer returns an

0 commit comments

Comments
 (0)