Wrong type for memory allocation calculation

Ian Collins <[email protected]>
Newsgroups gmane.comp.security.virus.clamav.devel
Message-ID <[email protected]>
Hello,

I'm new here, so please forgive me if I'm posting to the wrong list!

I think have found a bug in fmap.c which causes a crash when scanning a 
large file in a 64 bit build.

The function cl_fmap_open_handle uses an unsigned for mapsz (line 213), 
and then calculates the size (line 232) with

mapsz = pages * pgsz + hdrsz;

Where I had a crash, pages was 1047561, pgsz was 4096 and hdrsz was 
4194304, so the result (4,295,004,160) overflowed an unsigned.

These variables should be size_t (the correct size type for mmap).

-- 
Ian.

_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.