From 4ee74257940e2ed21b653b986ad02a746e8438a6 Mon Sep 17 00:00:00 2001 From: Thiago Macieira Date: Thu, 16 Mar 2017 21:36:17 -0700 Subject: Work around Linux libc overflow in mmap64 The mmap64 functions in all Linux libc fail to properly check that the value fits in the system call parameter. I guess the developers just said "16 PB are enough for everyone"... Change-Id: Ic39b2c4fd9c84522a8fafffd14ac91567ce09c09 Reviewed-by: Sami Nurmenniemi Reviewed-by: Olivier Goffart (Woboq GmbH) --- src/corelib/io/qfsfileengine_unix.cpp | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/corelib/io/qfsfileengine_unix.cpp b/src/corelib/io/qfsfileengine_unix.cpp index bf2f47d399..f8e31ed92b 100644 --- a/src/corelib/io/qfsfileengine_unix.cpp +++ b/src/corelib/io/qfsfileengine_unix.cpp @@ -688,6 +688,19 @@ QDateTime QFSFileEngine::fileTime(FileTime time) const uchar *QFSFileEnginePrivate::map(qint64 offset, qint64 size, QFile::MemoryMapFlags flags) { +#if (defined(Q_OS_LINUX) || defined(Q_OS_ANDROID)) && Q_PROCESSOR_WORDSIZE == 4 + // The Linux mmap2 system call on 32-bit takes a page-shifted 32-bit + // integer so the maximum offset is 1 << (32+12) (the shift is always 12, + // regardless of the actual page size). Unfortunately, the mmap64() + // function is known to be broken in all Linux libcs (glibc, uclibc, musl + // and Bionic): all of them do the right shift, but don't confirm that the + // result fits into the 32-bit parameter to the kernel. + + static qint64 MaxFileOffset = (Q_INT64_C(1) << (32+12)) - 1; +#else + static qint64 MaxFileOffset = std::numeric_limits::max(); +#endif + Q_Q(QFSFileEngine); Q_UNUSED(flags); if (openMode == QIODevice::NotOpen) { @@ -695,7 +708,7 @@ uchar *QFSFileEnginePrivate::map(qint64 offset, qint64 size, QFile::MemoryMapFla return 0; } - if (offset < 0 || offset != qint64(QT_OFF_T(offset)) + if (offset < 0 || offset > MaxFileOffset || size < 0 || quint64(size) > quint64(size_t(-1))) { q->setError(QFile::UnspecifiedError, qt_error_string(int(EINVAL))); return 0; -- cgit v1.2.3