diff options
| author | junglefowl <junglefowl@riseup.net> | 2017-01-23 19:08:54 +0000 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-01-25 13:21:44 -0500 |
| commit | 373d9aff7af41c07bb51093df4ceb51a13404a44 (patch) | |
| tree | a1b6786bf56410c69202c6e1de8cadad11070faa /src/common/compat.c | |
| parent | 1130fd87edb38570dbad9c1a04adfe0947490b2d (diff) | |
| download | tor-373d9aff7af41c07bb51093df4ceb51a13404a44.tar.gz tor-373d9aff7af41c07bb51093df4ceb51a13404a44.zip | |
Fail if file is too large to mmap.
If tor_mmap_file is called with a file which is larger than SIZE_MAX,
only a small part of the file will be memory-mapped due to integer
truncation.
This can only realistically happen on 32 bit architectures with large
file support.
Diffstat (limited to 'src/common/compat.c')
| -rw-r--r-- | src/common/compat.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/common/compat.c b/src/common/compat.c index ebf05f59e1..16b222904a 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -258,6 +258,12 @@ tor_mmap_file(const char *filename) page_size = getpagesize(); size += (size%page_size) ? page_size-(size%page_size) : 0; + if (st.st_size > SSIZE_T_CEILING || size < st.st_size) { + log_warn(LD_FS, "File \"%s\" is too large. Ignoring.",filename); + errno = EFBIG; + close(fd); + return NULL; + } if (!size) { /* Zero-length file. If we call mmap on it, it will succeed but * return NULL, and bad things will happen. So just fail. */ |