Commit 342019bb authored by Andrei Vagin's avatar Andrei Vagin

zdtm: avoid arithmetic overflow in datagen and datachk

p + FAST_SIZE > buffer + length

In this sentence p + FAST_SIZE may be bigger than (1<<32),
and we will be in trouble.

$ gdb -c coredump test/zdtm/static/write_read01

(gdb) p p
$3 = (uint8_t *) 0xffffa89e
(gdb) p buffer
$4 = (uint8_t *) 0xfff06780
(gdb) p length
$5 = 1000000
Signed-off-by: 's avatarAndrei Vagin <avagin@virtuozzo.com>
parent 9ad12876
...@@ -14,42 +14,42 @@ ...@@ -14,42 +14,42 @@
static void datagen_fast(uint8_t *buffer, unsigned length, uint32_t *crc) static void datagen_fast(uint8_t *buffer, unsigned length, uint32_t *crc)
{ {
uint8_t *p; size_t off;
datagen(buffer, FAST_SIZE, crc); datagen(buffer, FAST_SIZE, crc);
p = buffer + FAST_SIZE; off = FAST_SIZE;
while (p < buffer + length) { while (off < length) {
unsigned long size = FAST_SIZE; unsigned long size = FAST_SIZE;
if (p + FAST_SIZE > buffer + length) if (off + FAST_SIZE > length)
size = buffer + length - p; size = length - off;
memcpy(p, buffer, size); memcpy(buffer + off, buffer, size);
p += FAST_SIZE; off += size;
} }
} }
static int datachk_fast(const uint8_t *buffer, unsigned length, uint32_t *crc) static int datachk_fast(const uint8_t *buffer, unsigned length, uint32_t *crc)
{ {
const uint8_t *p; size_t off;
if (datachk(buffer, FAST_SIZE, crc)) if (datachk(buffer, FAST_SIZE, crc))
return 1; return 1;
p = buffer + FAST_SIZE; off = FAST_SIZE;
while (p < buffer + length) { while (off < length) {
unsigned long size = FAST_SIZE; unsigned long size = FAST_SIZE;
if (p + FAST_SIZE > buffer + length) if (off + FAST_SIZE > length)
size = buffer + length - p; size = length - off;
if (memcmp(p, buffer, size)) { if (memcmp(buffer + off, buffer, size)) {
test_msg("Memory corruption [%p, %p]\n", p, p + size); test_msg("Memory corruption [%p, %p]\n", buffer, buffer + size);
return 1; return 1;
} }
p += FAST_SIZE; off += size;
} }
return 0; return 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment