Integer overflow in `round_up_to_page_size()`
Describe the bug
There is an integer overflow in round_up_to_page_size()
at src/platform/redox/mod.rs:48 when program calls memory related syscall (i.e., mmap
, munmap
, and mprotect
) with large len
.
To Reproduce
- Compile a program which calls system call
munmap
with largelen
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>
int main() {
void *addr = mmap(NULL, 4096, 0x3, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
munmap(addr, 0xffffffffffffffff);
return EXIT_SUCCESS;
}
- Run the compiled program
Logs
I add overflow-checks = true
for relibc.
user:~# munmap
RELIBC PANIC: panicked at src/platform/redox/mod.rs:48:6:
attempt to add with overflow