Skip to content

harden size calculations, bounds checks, and SHM layout validation#626

Open
metsw24-max wants to merge 1 commit intoapache:trunkfrom
metsw24-max:slotmem-hardening-overflow-bounds
Open

harden size calculations, bounds checks, and SHM layout validation#626
metsw24-max wants to merge 1 commit intoapache:trunkfrom
metsw24-max:slotmem-hardening-overflow-bounds

Conversation

@metsw24-max
Copy link
Copy Markdown

adds overflow-safe helpers for size arithmetic and applies them to all allocation and layout calculations in both slotmem backends

rejects creation when item_size * item_num or derived sizes overflow preventing under-allocation that could lead to out-of-bounds access during slot indexing

replaces direct size expressions with validated basesize, inuse_size, and alloc_size to ensure all memory allocations are correctly bounded

adds checks in slotmem_get and slotmem_put to ensure dest_len and src_len do not exceed the fixed slot size, preventing out-of-bounds reads and writes via memcpy

reorders validation so that slot index bounds are checked before deriving pointers like inuse + id, avoiding invalid pointer computation

adds guards against overflow in pointer arithmetic size * id before computing slot addresses

validates shared memory layout during slotmem_attach by recomputing expected size from descriptor fields and ensuring it does not exceed the actual segment size

prevents use of corrupted or inconsistent shared memory segments that could otherwise lead to invalid memory access

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant