From 2b63cdbdc98de0785763c6b816a035dc9f4589f3 Mon Sep 17 00:00:00 2001 From: Nitin Date: Mon, 27 Jul 2026 14:00:08 +0530 Subject: [PATCH] Fix SEC shard count integer overflow (#2892) Limit hpa_sec_nshards and experimental_pac_sec_nshards to 255 to prevent uint8_t overflow and multiplication overflow during initialization. --- src/conf.c | 8 ++++---- src/sec.c | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/conf.c b/src/conf.c index 50f43a20..61cf9038 100644 --- a/src/conf.c +++ b/src/conf.c @@ -937,8 +937,8 @@ malloc_conf_init_helper(sc_data_t *sc_data, unsigned bin_shard_sizes[SC_NBINS], CONF_CONTINUE; } CONF_HANDLE_SIZE_T(opt_hpa_sec_opts.nshards, - "hpa_sec_nshards", 0, 0, CONF_CHECK_MIN, - CONF_DONT_CHECK_MAX, true); + "hpa_sec_nshards", 0, 255, CONF_CHECK_MIN, + CONF_CHECK_MAX, true); CONF_HANDLE_SIZE_T(opt_hpa_sec_opts.max_alloc, "hpa_sec_max_alloc", PAGE, USIZE_GROW_SLOW_THRESHOLD, CONF_CHECK_MIN, @@ -947,8 +947,8 @@ malloc_conf_init_helper(sc_data_t *sc_data, unsigned bin_shard_sizes[SC_NBINS], "hpa_sec_max_bytes", SEC_OPTS_MAX_BYTES_DEFAULT, 0, CONF_CHECK_MIN, CONF_DONT_CHECK_MAX, true); CONF_HANDLE_SIZE_T(opt_pac_sec_opts.nshards, - "experimental_pac_sec_nshards", 0, 0, - CONF_CHECK_MIN, CONF_DONT_CHECK_MAX, true); + "experimental_pac_sec_nshards", 0, 255, + CONF_CHECK_MIN, CONF_CHECK_MAX, true); CONF_HANDLE_SIZE_T(opt_pac_sec_opts.max_alloc, "experimental_pac_sec_max_alloc", PAGE, USIZE_GROW_SLOW_THRESHOLD, CONF_CHECK_MIN, diff --git a/src/sec.c b/src/sec.c index b1b0e307..8dc973a3 100644 --- a/src/sec.c +++ b/src/sec.c @@ -36,6 +36,7 @@ sec_init(tsdn_t *tsdn, sec_t *sec, base_t *base, const sec_opts_t *opts) { sec->opts.max_alloc = 0; return false; } + assert(opts->nshards <= 255); assert(opts->max_alloc >= PAGE); /*