From mboxrd@z Thu Jan 1 00:00:00 1970 From: Slawomir Mrozowicz Subject: [PATCH v5] eal: out-of-bounds write Date: Thu, 16 Jun 2016 16:52:18 +0200 Message-ID: <1466088738-16990-1-git-send-email-slawomirx.mrozowicz@intel.com> Cc: dev@dpdk.org, Slawomir Mrozowicz To: david.marchand@6wind.com Return-path: Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by dpdk.org (Postfix) with ESMTP id 1D3EBC66A for ; Thu, 16 Jun 2016 15:52:31 +0200 (CEST) List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Overrunning array mcfg->memseg of 256 44-byte elements at element index 257 using index j. Fixed by add condition with message information. Fixes: af75078fece3 ("first public release") Coverity ID 13282 Signed-off-by: Slawomir Mrozowicz --- v5: - update message v4: - remove check condition from loop v3: - add check condition inside and outside the loop v2: - add message information --- lib/librte_eal/linuxapp/eal/eal_memory.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/librte_eal/linuxapp/eal/eal_memory.c b/lib/librte_eal/linuxapp/eal/eal_memory.c index 5b9132c..ffe069c 100644 --- a/lib/librte_eal/linuxapp/eal/eal_memory.c +++ b/lib/librte_eal/linuxapp/eal/eal_memory.c @@ -1301,6 +1301,14 @@ rte_eal_hugepage_init(void) break; } + if (j >= RTE_MAX_MEMSEG) { + RTE_LOG(ERR, EAL, + "All memory segments exhausted by IVSHMEM. " + "Try recompiling with larger RTE_MAX_MEMSEG " + "then current %d\n", RTE_MAX_MEMSEG); + return -ENOMEM; + } + for (i = 0; i < nr_hugefiles; i++) { new_memseg = 0; -- 1.9.1