Check size_t bounds overflow in create_mem_region

1 files changed, 4 insertions, 2 deletions

diff --git a/riscv/cfg.cc b/riscv/cfg.cc
index 8763240..2f9a229 100644
--- a/riscv/cfg.cc
+++ b/riscv/cfg.cc
@@ -18,13 +18,15 @@ bool mem_cfg_t::check_if_supported(reg_t base, reg_t size)
   // the regions in the first place, but we have them here to make sure that
   // we can't end up describing memory regions that don't make sense. They
   // ask that the page size is a multiple of the minimum page size, that the
-  // page is aligned to the minimum page size, that the page is non-empty and
-  // that the top address is still representable in a reg_t.
+  // page is aligned to the minimum page size, that the page is non-empty,
+  // that the size doesn't overflow size_t, and that the top address is still
+  // representable in a reg_t.
   //
   // Note: (base + size == 0) part of the assertion is to handle cases like
   //   { base = 0xffff_ffff_ffff_f000, size: 0x1000 }
   return (size % PGSIZE == 0) &&
          (base % PGSIZE == 0) &&
+         (size_t(size) == size) &&
          (size > 0) &&
          ((base + size > base) || (base + size == 0));
 }