Skip to content

Commit 837c2e7

Browse files
committed
fix(memory): avoid overflow in sum of memory region lengths
The fuzzer caught an issue with the sum of the memory region lengths that could lead to an overflow as there is no check. Replace the sum with a try_fold to also check for overflow. Signed-off-by: Riccardo Mancini <mancio@amazon.com>
1 parent 8f3d17a commit 837c2e7

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/vmm/src/vstate/memory.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,10 @@ pub fn snapshot_file(
297297
track_dirty_pages: bool,
298298
) -> Result<Vec<GuestRegionMmap>, MemoryError> {
299299
let regions: Vec<_> = regions.collect();
300-
let memory_size: u64 = regions.iter().map(|(_, size)| *size as u64).sum();
300+
let memory_size = regions
301+
.iter()
302+
.try_fold(0u64, |acc, (_, size)| acc.checked_add(*size as u64))
303+
.ok_or(MemoryError::OffsetTooLarge)?;
301304
let file_size = file.metadata().map_err(MemoryError::FileMetadata)?.len();
302305

303306
// ensure we do not mmap beyond EOF. The kernel would allow that but a SIGBUS is triggered

0 commit comments

Comments
 (0)