Fix integer overflow for ridiculously large configured recv buffer

erlang · Sep 30, 2024 · 0427f24 · 0427f24
1 parent 620fab3
commit 0427f24
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/erts/emulator/drivers/common/inet_drv.c b/erts/emulator/drivers/common/inet_drv.c
@@ -14696,8 +14696,12 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event)
             ASSERT(IS_SCTP(desc));
             bufsz = udesc->i_ptr - udesc->i_buf->orig_bytes;
             if (udesc->i_bufsz - bufsz < desc->bufsz) { /* Headroom */
-                bufsz = udesc->i_bufsz + desc->bufsz;
-                if ((tmp = realloc_buffer(udesc->i_buf, bufsz)) == NULL) {
+                int new_bufsz;
+                new_bufsz = udesc->i_bufsz + desc->bufsz;
+                if (new_bufsz < 0) /* Overflow? */
+                    new_bufsz = bufsz + desc->bufsz; /* Minimal realloc */
+                if (new_bufsz < 0 /* Also overflow? */ ||
+                    (tmp = realloc_buffer(udesc->i_buf, new_bufsz)) == NULL) {
                     release_buffer(udesc->i_buf);
                     udesc->i_buf = NULL;
                     return packet_error(udesc, ENOMEM);
@@ -14706,7 +14710,7 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event)
                     tmp->orig_bytes +
                     (udesc->i_ptr - udesc->i_buf->orig_bytes);
                 udesc->i_buf = tmp;
-                udesc->i_bufsz = bufsz;
+                udesc->i_bufsz = new_bufsz;
             }
             have_fragment = TRUE;
 	} else