alex/genode
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

nic session: fix quota check

Browse Source 
Check for overflow.

Issue #1735
This commit is contained in:
Sebastian Sumpf
2015-10-07 10:38:41 +02:00
committed by Christian Helmuth
parent 5aec67d5bb
commit 78e18981fb
6 changed files with 18 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
repos/dde_linux/src/lib/usb/include/usb_nic_component.h
View File

@@ -242,12 +242,10 @@ class Root : public Root_component
/*
* Check if donated ram quota suffices for both communication
* buffers. Also check both sizes separately to handle a
* possible overflow of the sum of both sizes.
* buffers and check for overflow
*/
if (tx_buf_size > ram_quota - session_size
|| rx_buf_size > ram_quota - session_size
|| tx_buf_size + rx_buf_size > ram_quota - session_size) {
if (tx_buf_size + rx_buf_size < tx_buf_size ||
tx_buf_size + rx_buf_size > ram_quota - session_size) {
PERR("insufficient 'ram_quota', got %zd, need %zd",
ram_quota, tx_buf_size + rx_buf_size + session_size);
throw Genode::Root::Quota_exceeded();

8
repos/dde_linux/src/lib/wifi/nic.cc
View File

@@ -203,12 +203,10 @@ class Root : public Genode::Root_component<Wifi_session_component,
/*
* Check if donated ram quota suffices for both communication
* buffers. Also check both sizes separately to handle a
* possible overflow of the sum of both sizes.
* buffers and check for overflow
*/
if (tx_buf_size > ram_quota - session_size
|| rx_buf_size > ram_quota - session_size
|| tx_buf_size + rx_buf_size > ram_quota - session_size) {
if (tx_buf_size + rx_buf_size < tx_buf_size ||
tx_buf_size + rx_buf_size > ram_quota - session_size) {
PERR("insufficient 'ram_quota', got %zd, need %zd",
ram_quota, tx_buf_size + rx_buf_size + session_size);
throw Genode::Root::Quota_exceeded();