commit 9d6d33a5613544b68e5ad8298cb164e71d56548c
author Ruslan Ermilov <ru@nginx.com> Thu Aug 30 15:09:21 2012 +0000
committer Ruslan Ermilov <ru@nginx.com> Thu Aug 30 15:09:21 2012 +0000
tree 2a18ef72a1f31a7b423638f23711bcea84b12399
parent d469482cda460107c034f8d9e723de830a1f768e

Fixed overflow if ngx_slab_alloc() is called with very big "size" argument.

src/core/ngx_slab.c

diff --git a/src/core/ngx_slab.c b/src/core/ngx_slab.c
index 782792d..ae9d6f3 100644
--- a/src/core/ngx_slab.c
+++ b/src/core/ngx_slab.c
@@ -162,8 +162,8 @@
         ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,
                        "slab alloc: %uz", size);
 
-        page = ngx_slab_alloc_pages(pool, (size + ngx_pagesize - 1)
-                                          >> ngx_pagesize_shift);
+        page = ngx_slab_alloc_pages(pool, (size >> ngx_pagesize_shift)
+                                          + ((size % ngx_pagesize) ? 1 : 0));
         if (page) {
             p = (page - pool->pages) << ngx_pagesize_shift;
             p += (uintptr_t) pool->start;