mm: Avoid integer overflow.

diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c
index 1c3d02388f09d08787bd596b626c15cabad623ff..ee88ff61187a18c477d74c5a20d1ef5442a3c3ac 100644 (file)
--- a/grub-core/kern/mm.c
+++ b/grub-core/kern/mm.c
@@ -325,6 +325,15 @@ grub_memalign (grub_size_t align, grub_size_t size)
   if (!grub_mm_base)
     goto fail;
 
+  if (size > ~(grub_size_t) align)
+    goto fail;
+
+  /* We currently assume at least a 32-bit grub_size_t,
+     so limiting allocations to <adress space size> - 1MiB
+     in name of sanity is beneficial. */
+  if ((size + align) > ~(grub_size_t) 0x100000)
+    goto fail;
+
   align = (align >> GRUB_MM_ALIGN_LOG2);
   if (align == 0)
     align = 1;