patch-2.0.9 linux/ipc/shm.c

• Lines: 21
• Date: Tue Jul 23 10:26:53 1996
• Orig file: v2.0.8/linux/ipc/shm.c
• Orig date: Sat Apr 27 15:20:07 1996

diff -u --recursive --new-file v2.0.8/linux/ipc/shm.c linux/ipc/shm.c
@@ -467,6 +467,7 @@
 	int err;
 	unsigned int id;
 	unsigned long addr;
+	unsigned long len;
 
 	if (shmid < 0) {
 		/* printk("shmat() -> EINVAL because shmid = %d < 0\n",shmid); */
@@ -490,6 +491,12 @@
 		else
 			return -EINVAL;
 	}
+	/*
+	 * Check if addr exceeds TASK_SIZE (from do_mmap)
+	 */
+	len = PAGE_SIZE*shp->shm_npages;
+       if (addr >= TASK_SIZE || len > TASK_SIZE  || addr > TASK_SIZE - len)
+		return -EINVAL;
 	/*
 	 * If shm segment goes below stack, make sure there is some
 	 * space left for the stack to grow (presently 4 pages).