shithub: riscv

Info  •  Files  •  Log  •  Branches

cwfs: fix 32bit multiplication overflows for allocation sizes (thanks kenji okomoto)

--- a/sys/src/cmd/cwfs/main.c

+++ b/sys/src/cmd/cwfs/main.c

@@ -323,15 +323,15 @@

 	netinit();

 	scsiinit();

-	files = ialloc(conf.nfile * sizeof(*files), 0);

+	files = ialloc((uintptr)conf.nfile * sizeof(*files), 0);

 	for(i=0; i < conf.nfile; i++) {

 		qlock(&files[i]);

 		qunlock(&files[i]);

 	}

-	wpaths = ialloc(conf.nwpath * sizeof(*wpaths), 0);

-	uid = ialloc(conf.nuid * sizeof(*uid), 0);

-	gidspace = ialloc(conf.gidspace * sizeof(*gidspace), 0);

+	wpaths = ialloc((uintptr)conf.nwpath * sizeof(*wpaths), 0);

+	uid = ialloc((uintptr)conf.nuid * sizeof(*uid), 0);

+	gidspace = ialloc((uintptr)conf.gidspace * sizeof(*gidspace), 0);

 	iobufinit();

--- a/sys/src/cmd/cwfs/malloc.c

+++ b/sys/src/cmd/cwfs/malloc.c

@@ -100,7 +100,7 @@

 		nhiob++;

 	if(chatty)

 		print("\t%ud buffers; %ud hashes\n", niob, nhiob);

-	hiob = ialloc(nhiob * sizeof(Hiob), 0);

+	hiob = ialloc((uintptr)nhiob * sizeof(Hiob), 0);

 	hp = hiob;

 	for(i=0; i<nhiob; i++) {

 		lock(hp);

@@ -107,8 +107,8 @@

 		unlock(hp);

 		hp++;

 	}

-	p = ialloc(niob * sizeof(Iobuf), 0);

-	xiop = ialloc(niob * RBUFSIZE, 0);

+	p = ialloc((uintptr)niob * sizeof(Iobuf), 0);

+	xiop = ialloc((uintptr)niob * RBUFSIZE, 0);

 	hp = hiob;

 	for(i=0; i < niob; i++) {

 		qlock(p);

--- a/sys/src/cmd/cwfs/mworm.c

+++ b/sys/src/cmd/cwfs/mworm.c

@@ -14,7 +14,7 @@

 		d->cat.ndev++;

 	}

-	list = ialloc(d->cat.ndev * sizeof(Device*), 0);

+	list = ialloc((uintptr)d->cat.ndev * sizeof(Device*), 0);

 	d->private = list;

 	for(x=d->cat.first; x; x=x->link) {

 		*list++ = x;

--- a/sys/src/cmd/cwfs/sub.c

+++ b/sys/src/cmd/cwfs/sub.c

@@ -38,7 +38,7 @@

 	Chan *cp, *icp;

 	int i;

-	p = ialloc(count * (sizeof(Chan)+data), 0);

+	p = ialloc((uintptr)count * (sizeof(Chan)+data), 0);

 	icp = (Chan*)p;

 	for(i = 0; i < count; i++) {

 		cp = (Chan*)p;