diff options
author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-07 14:55:12 +0100 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-08 11:29:54 +0100 |
commit | cfde94be1d4286bc47633c6e6eaf4e659bd78066 (patch) | |
tree | e4402ee647d09cb81a2a936cf6c59fb53dce7be1 | |
parent | 70cfc6afc42b9c299e9c05359f12455055105fac (diff) |
Bug 697985: bounds check the array allocations methods
The clump allocator has four allocation functions that use 'number of elements'
and 'size of elements' parameters (rather than a simple 'number of bytes').
Those need specific bounds checking.
-rw-r--r-- | base/gsalloc.c | 42 |
1 files changed, 28 insertions, 14 deletions
diff --git a/base/gsalloc.c b/base/gsalloc.c index 741ba008f..10c04dddd 100644 --- a/base/gsalloc.c +++ b/base/gsalloc.c | |||
@@ -1248,19 +1248,32 @@ i_alloc_struct_immovable(gs_memory_t * mem, gs_memory_type_ptr_t pstype, | |||
1248 | alloc_trace("|+<.", imem, cname, pstype, size, obj); | 1248 | alloc_trace("|+<.", imem, cname, pstype, size, obj); |
1249 | return obj; | 1249 | return obj; |
1250 | } | 1250 | } |
1251 | |||
1252 | static inline bool | ||
1253 | alloc_array_check_size(ulong num_elements, ulong elt_size, ulong *lsize) | ||
1254 | { | ||
1255 | int64_t s = (int64_t)num_elements * elt_size; | ||
1256 | if (s > max_uint) { | ||
1257 | return false; | ||
1258 | } | ||
1259 | *lsize = (ulong)s; | ||
1260 | return true; | ||
1261 | } | ||
1262 | |||
1251 | static byte * | 1263 | static byte * |
1252 | i_alloc_byte_array(gs_memory_t * mem, uint num_elements, uint elt_size, | 1264 | i_alloc_byte_array(gs_memory_t * mem, uint num_elements, uint elt_size, |
1253 | client_name_t cname) | 1265 | client_name_t cname) |
1254 | { | 1266 | { |
1255 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; | 1267 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; |
1256 | obj_header_t *obj; | 1268 | obj_header_t *obj; |
1257 | 1269 | ulong lsize; | |
1258 | #ifdef MEMENTO | 1270 | #ifdef MEMENTO |
1259 | if (Memento_failThisEvent()) | 1271 | if (Memento_failThisEvent()) |
1260 | return NULL; | 1272 | return NULL; |
1261 | #endif | 1273 | #endif |
1262 | 1274 | if (alloc_array_check_size(num_elements, elt_size, &lsize) == false) | |
1263 | obj = alloc_obj(imem, (ulong) num_elements * elt_size, | 1275 | return NULL; |
1276 | obj = alloc_obj(imem, lsize, | ||
1264 | &st_bytes, ALLOC_DIRECT, cname); | 1277 | &st_bytes, ALLOC_DIRECT, cname); |
1265 | 1278 | ||
1266 | if_debug6m('A', mem, "[a%d:+b.]%s -bytes-*(%lu=%u*%u) = 0x%lx\n", | 1279 | if_debug6m('A', mem, "[a%d:+b.]%s -bytes-*(%lu=%u*%u) = 0x%lx\n", |
@@ -1275,13 +1288,14 @@ i_alloc_byte_array_immovable(gs_memory_t * mem, uint num_elements, | |||
1275 | { | 1288 | { |
1276 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; | 1289 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; |
1277 | obj_header_t *obj; | 1290 | obj_header_t *obj; |
1278 | 1291 | ulong lsize; | |
1279 | #ifdef MEMENTO | 1292 | #ifdef MEMENTO |
1280 | if (Memento_failThisEvent()) | 1293 | if (Memento_failThisEvent()) |
1281 | return NULL; | 1294 | return NULL; |
1282 | #endif | 1295 | #endif |
1283 | 1296 | if (alloc_array_check_size(num_elements, elt_size, &lsize) == false) | |
1284 | obj = alloc_obj(imem, (ulong) num_elements * elt_size, | 1297 | return NULL; |
1298 | obj = alloc_obj(imem, lsize, | ||
1285 | &st_bytes, ALLOC_IMMOVABLE | ALLOC_DIRECT, | 1299 | &st_bytes, ALLOC_IMMOVABLE | ALLOC_DIRECT, |
1286 | cname); | 1300 | cname); |
1287 | 1301 | ||
@@ -1297,7 +1311,7 @@ i_alloc_struct_array(gs_memory_t * mem, uint num_elements, | |||
1297 | { | 1311 | { |
1298 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; | 1312 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; |
1299 | obj_header_t *obj; | 1313 | obj_header_t *obj; |
1300 | 1314 | ulong lsize; | |
1301 | #ifdef MEMENTO | 1315 | #ifdef MEMENTO |
1302 | if (Memento_failThisEvent()) | 1316 | if (Memento_failThisEvent()) |
1303 | return NULL; | 1317 | return NULL; |
@@ -1311,9 +1325,9 @@ i_alloc_struct_array(gs_memory_t * mem, uint num_elements, | |||
1311 | return NULL; /* fail */ | 1325 | return NULL; /* fail */ |
1312 | } | 1326 | } |
1313 | #endif | 1327 | #endif |
1314 | obj = alloc_obj(imem, | 1328 | if (alloc_array_check_size(num_elements, pstype->ssize, &lsize) == false) |
1315 | (ulong) num_elements * pstype->ssize, | 1329 | return NULL; |
1316 | pstype, ALLOC_DIRECT, cname); | 1330 | obj = alloc_obj(imem, lsize, pstype, ALLOC_DIRECT, cname); |
1317 | if_debug7m('A', mem, "[a%d:+<.]%s %s*(%lu=%u*%u) = 0x%lx\n", | 1331 | if_debug7m('A', mem, "[a%d:+<.]%s %s*(%lu=%u*%u) = 0x%lx\n", |
1318 | alloc_trace_space(imem), client_name_string(cname), | 1332 | alloc_trace_space(imem), client_name_string(cname), |
1319 | struct_type_name_string(pstype), | 1333 | struct_type_name_string(pstype), |
@@ -1327,16 +1341,16 @@ i_alloc_struct_array_immovable(gs_memory_t * mem, uint num_elements, | |||
1327 | { | 1341 | { |
1328 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; | 1342 | gs_ref_memory_t * const imem = (gs_ref_memory_t *)mem; |
1329 | obj_header_t *obj; | 1343 | obj_header_t *obj; |
1330 | 1344 | ulong lsize; | |
1331 | #ifdef MEMENTO | 1345 | #ifdef MEMENTO |
1332 | if (Memento_failThisEvent()) | 1346 | if (Memento_failThisEvent()) |
1333 | return NULL; | 1347 | return NULL; |
1334 | #endif | 1348 | #endif |
1335 | 1349 | ||
1336 | ALLOC_CHECK_SIZE(mem,pstype); | 1350 | ALLOC_CHECK_SIZE(mem,pstype); |
1337 | obj = alloc_obj(imem, | 1351 | if (alloc_array_check_size(num_elements, pstype->ssize, &lsize) == false) |
1338 | (ulong) num_elements * pstype->ssize, | 1352 | return NULL; |
1339 | pstype, ALLOC_IMMOVABLE | ALLOC_DIRECT, cname); | 1353 | obj = alloc_obj(imem, lsize, pstype, ALLOC_IMMOVABLE | ALLOC_DIRECT, cname); |
1340 | if_debug7m('A', mem, "[a%d|+<.]%s %s*(%lu=%u*%u) = 0x%lx\n", | 1354 | if_debug7m('A', mem, "[a%d|+<.]%s %s*(%lu=%u*%u) = 0x%lx\n", |
1341 | alloc_trace_space(imem), client_name_string(cname), | 1355 | alloc_trace_space(imem), client_name_string(cname), |
1342 | struct_type_name_string(pstype), | 1356 | struct_type_name_string(pstype), |