cwfs: fix 32bit multiplication overflows for allocation sizes (thanks kenji okomoto)

diff --git a/sys/src/cmd/cwfs/main.c b/sys/src/cmd/cwfs/main.c
index eaba6c1c165afd7246cfb34e4a53bcb4ec4bdb1b..97ce1cb42c73356d1c9aa5e7ed1fdcc067ec611b 100644 (file)
--- a/sys/src/cmd/cwfs/main.c
+++ b/sys/src/cmd/cwfs/main.c
@@ -323,15 +323,15 @@ main(int argc, char **argv)
        netinit();
        scsiinit();
 
-       files = ialloc(conf.nfile * sizeof(*files), 0);
+       files = ialloc((uintptr)conf.nfile * sizeof(*files), 0);
        for(i=0; i < conf.nfile; i++) {
                qlock(&files[i]);
                qunlock(&files[i]);
        }
 
-       wpaths = ialloc(conf.nwpath * sizeof(*wpaths), 0);
-       uid = ialloc(conf.nuid * sizeof(*uid), 0);
-       gidspace = ialloc(conf.gidspace * sizeof(*gidspace), 0);
+       wpaths = ialloc((uintptr)conf.nwpath * sizeof(*wpaths), 0);
+       uid = ialloc((uintptr)conf.nuid * sizeof(*uid), 0);
+       gidspace = ialloc((uintptr)conf.gidspace * sizeof(*gidspace), 0);
 
        iobufinit();
 

diff --git a/sys/src/cmd/cwfs/malloc.c b/sys/src/cmd/cwfs/malloc.c
index 1655996232e93d4ad85ef127c19cb248d4cd9e0d..25ae33b5f84a827aaf1bbc919a47471eba364daf 100644 (file)
--- a/sys/src/cmd/cwfs/malloc.c
+++ b/sys/src/cmd/cwfs/malloc.c
@@ -100,15 +100,15 @@ iobufinit(void)
                nhiob++;
        if(chatty)
                print("\t%ud buffers; %ud hashes\n", niob, nhiob);
-       hiob = ialloc(nhiob * sizeof(Hiob), 0);
+       hiob = ialloc((uintptr)nhiob * sizeof(Hiob), 0);
        hp = hiob;
        for(i=0; i<nhiob; i++) {
                lock(hp);
                unlock(hp);
                hp++;
        }
-       p = ialloc(niob * sizeof(Iobuf), 0);
-       xiop = ialloc(niob * RBUFSIZE, 0);
+       p = ialloc((uintptr)niob * sizeof(Iobuf), 0);
+       xiop = ialloc((uintptr)niob * RBUFSIZE, 0);
        hp = hiob;
        for(i=0; i < niob; i++) {
                qlock(p);

diff --git a/sys/src/cmd/cwfs/mworm.c b/sys/src/cmd/cwfs/mworm.c
index b4d44423603ef1ca48bcf21d125597adb09d22cd..14e9dea5b51cfe5e6e89a34364b2ebef98890fff 100644 (file)
--- a/sys/src/cmd/cwfs/mworm.c
+++ b/sys/src/cmd/cwfs/mworm.c
@@ -14,7 +14,7 @@ mcatinit(Device *d)
                d->cat.ndev++;
        }
 
-       list = ialloc(d->cat.ndev * sizeof(Device*), 0);
+       list = ialloc((uintptr)d->cat.ndev * sizeof(Device*), 0);
        d->private = list;
        for(x=d->cat.first; x; x=x->link) {
                *list++ = x;

diff --git a/sys/src/cmd/cwfs/sub.c b/sys/src/cmd/cwfs/sub.c
index c73c3d3ab4eafb74deb97531c729d24e9f88205f..bf9a59e1d0839458bfdec080fbf1b87f7dbf150c 100644 (file)
--- a/sys/src/cmd/cwfs/sub.c
+++ b/sys/src/cmd/cwfs/sub.c
@@ -38,7 +38,7 @@ fs_chaninit(int count, int data)
        Chan *cp, *icp;
        int i;
 
-       p = ialloc(count * (sizeof(Chan)+data), 0);
+       p = ialloc((uintptr)count * (sizeof(Chan)+data), 0);
        icp = (Chan*)p;
        for(i = 0; i < count; i++) {
                cp = (Chan*)p;