diff options
| author | Michael Brown <mcb30@ipxe.org> | 2017-03-21 11:46:17 +0200 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2017-03-21 12:01:51 +0200 |
| commit | 6ee62eb24220d8e364728c007f0d6cb8285e544a (patch) | |
| tree | 13135a1c0ae9efa5e279c45ad053aaa896ca6e22 /src/drivers/infiniband | |
| parent | de2c6fa240fc3b42c91c06775de6a26eb4aa3faf (diff) | |
| download | ipxe-6ee62eb24220d8e364728c007f0d6cb8285e544a.tar.gz | |
[hermon] Avoid potential integer overflow when calculating memory mappings
When the area to be mapped straddles the 2GB boundary, the expression
(high+size) will overflow on the first loop iteration. Fix by using
(end-size), which cannot underflow.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/infiniband')
| -rw-r--r-- | src/drivers/infiniband/hermon.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/drivers/infiniband/hermon.c b/src/drivers/infiniband/hermon.c index 79d606093..2199a9d98 100644 --- a/src/drivers/infiniband/hermon.c +++ b/src/drivers/infiniband/hermon.c @@ -2135,7 +2135,7 @@ static int hermon_map_vpm ( struct hermon *hermon, if ( ( low - size ) >= start ) { low -= size; pa = low; - } else if ( ( high + size ) <= end ) { + } else if ( high <= ( end - size ) ) { pa = high; high += size; } else { |