Skip to content

Integer overflow in `round_up_to_page_size()`

Describe the bug

There is an integer overflow in round_up_to_page_size() at src/platform/redox/mod.rs:48 when program calls memory related syscall (i.e., mmap, munmap, and mprotect) with large len.

https://gitlab.redox-os.org/redox-os/relibc/-/blob/master/src/platform/redox/mod.rs?ref_type=heads#L47-49

To Reproduce

  1. Compile a program which calls system call munmap with large len
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <unistd.h>

int main() {
  void *addr = mmap(NULL, 4096, 0x3, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  munmap(addr, 0xffffffffffffffff);

  return EXIT_SUCCESS;
}
  1. Run the compiled program

Logs

I add overflow-checks = true for relibc.

user:~# munmap
RELIBC PANIC: panicked at src/platform/redox/mod.rs:48:6:
attempt to add with overflow