Merge "make mmap fail on requests larger than PTRDIFF_MAX"
diff --git a/libc/bionic/mmap.cpp b/libc/bionic/mmap.cpp
index 8f25a89..794f50f 100644
--- a/libc/bionic/mmap.cpp
+++ b/libc/bionic/mmap.cpp
@@ -30,6 +30,7 @@
#include <sys/mman.h>
#include <unistd.h>
+#include "private/bionic_macros.h"
#include "private/ErrnoRestorer.h"
// mmap2(2) is like mmap(2), but the offset is in 4096-byte blocks, not bytes.
@@ -45,6 +46,13 @@
return MAP_FAILED;
}
+ // prevent allocations large enough for `end - start` to overflow
+ size_t rounded = BIONIC_ALIGN(size, PAGE_SIZE);
+ if (rounded < size || size > PTRDIFF_MAX) {
+ errno = ENOMEM;
+ return MAP_FAILED;
+ }
+
bool is_private_anonymous = (flags & (MAP_PRIVATE | MAP_ANONYMOUS)) != 0;
void* result = __mmap2(addr, size, prot, flags, fd, offset >> MMAP2_SHIFT);