diff options
| author | Michael Brown | 2017-03-21 10:46:17 +0100 |
|---|---|---|
| committer | Michael Brown | 2017-03-21 11:01:51 +0100 |
| commit | 6ee62eb24220d8e364728c007f0d6cb8285e544a (patch) | |
| tree | 13135a1c0ae9efa5e279c45ad053aaa896ca6e22 /src | |
| parent | [dhcp] Allow vendor class to be changed in DHCP requests (diff) | |
| download | ipxe-6ee62eb24220d8e364728c007f0d6cb8285e544a.tar.gz ipxe-6ee62eb24220d8e364728c007f0d6cb8285e544a.tar.xz ipxe-6ee62eb24220d8e364728c007f0d6cb8285e544a.zip | |
[hermon] Avoid potential integer overflow when calculating memory mappings
When the area to be mapped straddles the 2GB boundary, the expression
(high+size) will overflow on the first loop iteration. Fix by using
(end-size), which cannot underflow.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/drivers/infiniband/hermon.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/infiniband/hermon.c b/src/drivers/infiniband/hermon.c index 79d606093..2199a9d98 100644 --- a/src/drivers/infiniband/hermon.c +++ b/src/drivers/infiniband/hermon.c @@ -2135,7 +2135,7 @@ static int hermon_map_vpm ( struct hermon *hermon, if ( ( low - size ) >= start ) { low -= size; pa = low; - } else if ( ( high + size ) <= end ) { + } else if ( high <= ( end - size ) ) { pa = high; high += size; } else { |