[PATCH 08/10] libsframe: check for overflow in sframe_fde_tbl_alloc

[Indu Bhagat]

sframe_fde_tbl_alloc() allocated memory for internal FDE entries based
on num_fdes * sizeof(sframe_func_desc_entry_int). If num_fdes was very
large (malicious input data), integer overflow could occur during size
calculation, producing a smaller allocation and resulting in potential
buffer overflow.

This addresses some concerns raised in the PR libsframe/34273.
---
 libsframe/sframe.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libsframe/sframe.c b/libsframe/sframe.c
index f047342a782..5ddd3962212 100644
--- a/libsframe/sframe.c
+++ b/libsframe/sframe.c
@@ -124,6 +124,12 @@ sframe_ret_set_errno (int *errp, int error)
 static int
 sframe_fde_tbl_alloc (sf_fde_tbl **fde_tbl, unsigned int num_fdes)
 {
+  size_t max_num_fdes = ((SIZE_MAX - sizeof (sf_fde_tbl))
+			 / sizeof (sframe_func_desc_entry_int));
+
+  if ((size_t) num_fdes > max_num_fdes)
+    return SFRAME_ERR;
+
   size_t fidx_size = num_fdes * sizeof (sframe_func_desc_entry_int);
   size_t fd_tbl_sz = (sizeof (sf_fde_tbl) + fidx_size);
 
-- 
2.43.0