From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 21 Mar 2017 09:46:17 +0000 (+0200)
Subject: [hermon] Avoid potential integer overflow when calculating memory mappings
X-Git-Tag: v1.20.1~289
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6ee62eb24220d8e364728c007f0d6cb8285e544a;p=thirdparty%2Fipxe.git

[hermon] Avoid potential integer overflow when calculating memory mappings

When the area to be mapped straddles the 2GB boundary, the expression
(high+size) will overflow on the first loop iteration.  Fix by using
(end-size), which cannot underflow.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/drivers/infiniband/hermon.c b/src/drivers/infiniband/hermon.c
index 79d606093..2199a9d98 100644
--- a/src/drivers/infiniband/hermon.c
+++ b/src/drivers/infiniband/hermon.c
@@ -2135,7 +2135,7 @@ static int hermon_map_vpm ( struct hermon *hermon,
 		if ( ( low - size ) >= start ) {
 			low -= size;
 			pa = low;
-		} else if ( ( high + size ) <= end ) {
+		} else if ( high <= ( end - size ) ) {
 			pa = high;
 			high += size;
 		} else {