diff options
| author | Michael Brown | 2017-03-21 10:46:17 +0100 |
|---|---|---|
| committer | Michael Brown | 2017-03-21 11:01:55 +0100 |
| commit | a5affc832e2ae5fbbc88aafa452354fa418578b4 (patch) | |
| tree | 780ef1c36836945b27e911312040578f0fd7a853 /src/drivers/infiniband | |
| parent | [hermon] Avoid potential integer overflow when calculating memory mappings (diff) | |
| download | ipxe-a5affc832e2ae5fbbc88aafa452354fa418578b4.tar.gz ipxe-a5affc832e2ae5fbbc88aafa452354fa418578b4.tar.xz ipxe-a5affc832e2ae5fbbc88aafa452354fa418578b4.zip | |
[arbel] Avoid potential integer overflow when calculating memory mappings
When the area to be mapped straddles the 2GB boundary, the expression
(high+size) will overflow on the first loop iteration. Fix by using
(end-size), which cannot underflow.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/infiniband')
| -rw-r--r-- | src/drivers/infiniband/arbel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/infiniband/arbel.c b/src/drivers/infiniband/arbel.c index 9671174c..ea65d8b8 100644 --- a/src/drivers/infiniband/arbel.c +++ b/src/drivers/infiniband/arbel.c @@ -1994,7 +1994,7 @@ static int arbel_map_vpm ( struct arbel *arbel, if ( ( low - size ) >= start ) { low -= size; pa = low; - } else if ( ( high + size ) <= end ) { + } else if ( high <= ( end - size ) ) { pa = high; high += size; } else { |