[hermon] Avoid potential integer overflow when calculating memory mappings

When the area to be mapped straddles the 2GB boundary, the expression
(high+size) will overflow on the first loop iteration.  Fix by using
(end-size), which cannot underflow.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/drivers/infiniband/hermon.c b/src/drivers/infiniband/hermon.c
index 79d606093538b0d7c86f4aa7a6ca489a1e82f8ff..2199a9d98d8c12bae01a26e4b75b21359f97ac17 100644 (file)
--- a/src/drivers/infiniband/hermon.c
+++ b/src/drivers/infiniband/hermon.c
@@ -2135,7 +2135,7 @@ static int hermon_map_vpm ( struct hermon *hermon,
                if ( ( low - size ) >= start ) {
                        low -= size;
                        pa = low;
-               } else if ( ( high + size ) <= end ) {
+               } else if ( high <= ( end - size ) ) {
                        pa = high;
                        high += size;
                } else {