diff --git a/libutils/FileMap.cpp b/libutils/FileMap.cpp index 1202c156d..c8286311f 100644 --- a/libutils/FileMap.cpp +++ b/libutils/FileMap.cpp @@ -189,7 +189,11 @@ bool FileMap::create(const char* origFileName, int fd, off64_t offset, size_t le int adjust = offset % mPageSize; off64_t adjOffset = offset - adjust; - size_t adjLength = length + adjust; + size_t adjLength; + if (__builtin_add_overflow(length, adjust, &adjLength)) { + ALOGE("adjusted length overflow: length %zu adjust %d", length, adjust); + return false; + } int flags = MAP_SHARED; int prot = PROT_READ; diff --git a/libutils/FileMap_test.cpp b/libutils/FileMap_test.cpp index 576d89bbe..096e27a56 100644 --- a/libutils/FileMap_test.cpp +++ b/libutils/FileMap_test.cpp @@ -32,3 +32,16 @@ TEST(FileMap, zero_length_mapping) { ASSERT_EQ(0u, m.getDataLength()); ASSERT_EQ(4096, m.getDataOffset()); } + +TEST(FileMap, offset_overflow) { + // Make sure that an end that overflows SIZE_MAX will not abort. + // See http://b/156997193. + TemporaryFile tf; + ASSERT_TRUE(tf.fd != -1); + + off64_t offset = 200; + size_t length = SIZE_MAX; + + android::FileMap m; + ASSERT_FALSE(m.create("test", tf.fd, offset, length, true)); +}