diff mbox series

[Openvpn-devel] Limit file size assignment to safe size_t range.

Message ID 20260701183650.29936-1-matthias.andree@gmx.de
State New
Headers
Series [Openvpn-devel] Limit file size assignment to safe size_t range. |

Commit Message

Matthias Andree July 1, 2026, 6:36 p.m. UTC 
  Some operating systems (FreeBSD 14 on i386) have
sizeof(size_t) == 4 (which is used for object sizes)
sizeof(off_t)  == 8 (which is used for file sizes),
so assigning a file size obtained from stat to a size_t
causes justified compiler warnings about a narrowing
conversion.

It is safe to assume a 32-bit platform will not want
to load a >= 4 GB file there, so let's just ASSERT()
that the off_t we are about to assign fits into
a size_t object.

Signed-off-by: Matthias Andree <matthias.andree@gmx.de>
---
 src/openvpn/buffer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Matthias Andree July 1, 2026, 6:42 p.m. UTC | #1 
This is against master and can be cherry-picked to release/2.7 and 
release/2.6.

Am 01.07.26 um 20:36 schrieb Matthias Andree via Openvpn-devel:
> Some operating systems (FreeBSD 14 on i386) have
> sizeof(size_t) == 4 (which is used for object sizes)
> sizeof(off_t)  == 8 (which is used for file sizes),
> so assigning a file size obtained from stat to a size_t
> causes justified compiler warnings about a narrowing
> conversion.
>
> It is safe to assume a 32-bit platform will not want
> to load a >= 4 GB file there, so let's just ASSERT()
> that the off_t we are about to assign fits into
> a size_t object.
>
> Signed-off-by: Matthias Andree <matthias.andree@gmx.de>
> ---
>   src/openvpn/buffer.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/src/openvpn/buffer.c b/src/openvpn/buffer.c
> index 5f2b2338..4b6acb36 100644
> --- a/src/openvpn/buffer.c
> +++ b/src/openvpn/buffer.c
> @@ -1391,7 +1391,10 @@ buffer_read_from_file(const char *filename, struct gc_arena *gc)
>           return ret;
>       }
>   
> -    const size_t size = file_stat.st_size;
> +    /* for some systems, off_t is 63 bits wide + sign bit and size_t is 32 bits
> +     * wide, and we need to avoid negative garbage wrapping around */
> +    ASSERT(file_stat.st_size >= 0 && file_stat.st_size <= SIZE_MAX);
> +    const size_t size = (size_t)file_stat.st_size;
>       ret = alloc_buf_gc(size + 1, gc); /* space for trailing \0 */
>       size_t read_size = fread(BPTR(&ret), 1, size, fp);
>       if (read_size == 0)
diff mbox series

Patch

diff --git a/src/openvpn/buffer.c b/src/openvpn/buffer.c
index 5f2b2338..4b6acb36 100644
--- a/src/openvpn/buffer.c
+++ b/src/openvpn/buffer.c
@@ -1391,7 +1391,10 @@  buffer_read_from_file(const char *filename, struct gc_arena *gc)
         return ret;
     }
 
-    const size_t size = file_stat.st_size;
+    /* for some systems, off_t is 63 bits wide + sign bit and size_t is 32 bits
+     * wide, and we need to avoid negative garbage wrapping around */
+    ASSERT(file_stat.st_size >= 0 && file_stat.st_size <= SIZE_MAX);
+    const size_t size = (size_t)file_stat.st_size;
     ret = alloc_buf_gc(size + 1, gc); /* space for trailing \0 */
     size_t read_size = fread(BPTR(&ret), 1, size, fp);
     if (read_size == 0)