Skip to content

fix(memory): use checked arithmetic in memfd_backed region sum - #6140

Open
dan1d wants to merge 1 commit into
firecracker-microvm:mainfrom
dan1d:fix/memfd-backed-overflow-check
Open

fix(memory): use checked arithmetic in memfd_backed region sum#6140
dan1d wants to merge 1 commit into
firecracker-microvm:mainfrom
dan1d:fix/memfd-backed-overflow-check

Conversation

@dan1d

@dan1d dan1d commented Aug 19, 2026

Copy link
Copy Markdown

Summary

The memfd_backed function uses an unchecked .sum() to calculate the total size of memory regions:

let size = regions.iter().map(|&(_, size)| size as u64).sum();

This could theoretically overflow if given sufficiently large region sizes.

This PR applies the same fix that was made to snapshot_file in commit 837c2e7: replace the unchecked sum with try_fold and checked_add, returning MemoryError::OffsetTooLarge on overflow.

Changes

  • Replace .sum() with .try_fold() + checked_add() in memfd_backed
  • Return MemoryError::OffsetTooLarge on overflow (consistent with snapshot_file)

Test plan

  • Existing unit tests pass
  • The fix mirrors the pattern already used in snapshot_file (lines 909-912)

Related

  • Commit 837c2e7 fixed the same pattern in snapshot_file
  • This ensures consistency across memory allocation functions

The memfd_backed function used an unchecked .sum() to calculate the
total size of memory regions. This could theoretically overflow if
given sufficiently large region sizes.

This change applies the same fix that was made to snapshot_file in
commit 837c2e7: replace the unchecked sum with try_fold and
checked_add, returning MemoryError::OffsetTooLarge on overflow.

Signed-off-by: Daniel <danielfromarg@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant