]> git.ipfire.org Git - thirdparty/qemu.git/commit
linux-user: Fix signed math overflow in brk() syscall
authorHelge Deller <deller@gmx.de>
Mon, 17 Jul 2023 10:39:38 +0000 (12:39 +0200)
committerMichael Tokarev <mjt@tls.msk.ru>
Mon, 31 Jul 2023 05:52:38 +0000 (08:52 +0300)
commitf90a8b9357e1f0289f6d2975378ee0466f272e45
tree01e95807706dd523830da0c524de95a6c15a5448
parentc4a4731408aca296ad88770e8a545b42e40a5d56
linux-user: Fix signed math overflow in brk() syscall

Fix the math overflow when calculating the new_malloc_size.

new_host_brk_page and brk_page are unsigned integers. If userspace
reduces the heap, new_host_brk_page is lower than brk_page which results
in a huge positive number (but should actually be negative).

Fix it by adding a proper check and as such make the code more readable.

Signed-off-by: Helge Deller <deller@gmx.de>
Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Cc: qemu-stable@nongnu.org
Buglink: https://github.com/upx/upx/issues/683
(cherry picked from commit eac78a4b0b7da4de2c0a297f4d528ca9cc6256a3)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
linux-user/syscall.c