[PATCH] do_brk() bounds checking

check that the brk value lies in bounds.

[PATCH] do_brk() bounds checking
check that the brk value lies in bounds.
722c4748 · Andrew Morton · Linus Torvalds · fa7cccc7 · 722c4748
Commit 722c4748 authored Sep 24, 2003 by Andrew Morton Committed by Linus Torvalds Sep 24, 2003
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

mm/mmap.c mm/mmap.c +3 -0

No files found.
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1269,6 +1269,9 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
 	if (!len)
 		return addr;

+	if ((addr + len) > TASK_SIZE || (addr + len) < addr)
+		return -EINVAL;
+
 	/*
 	 * mlock MCL_FUTURE?
 	 */