add overflow checks for IPC handle size

Author: bratpiorka

src/ipc.c

@@ -1,6 +1,6 @@
 /*
  *
- * Copyright (C) 2023-2025 Intel Corporation
+ * Copyright (C) 2023-2026 Intel Corporation
  *
  * Under the Apache License v2.0 with LLVM Exceptions. See LICENSE.TXT.
  * SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
@@ -45,6 +45,11 @@ umf_result_t umfPoolGetIPCHandleSize(umf_memory_pool_handle_t hPool,
         return ret;
     }
 
+    if (providerIPCHandleSize > SIZE_MAX - sizeof(umf_ipc_data_t)) {
+        LOG_ERR("IPC handle size is too large.");
+        return UMF_RESULT_ERROR_INVALID_ARGUMENT;
+    }
+
     *size = sizeof(umf_ipc_data_t) + providerIPCHandleSize;
 
     return ret;

src/provider/provider_tracking.c

@@ -1,6 +1,6 @@
 /*
  *
- * Copyright (C) 2023-2025 Intel Corporation
+ * Copyright (C) 2023-2026 Intel Corporation
  *
  * Under the Apache License v2.0 with LLVM Exceptions. See LICENSE.TXT.
  * SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
@@ -1108,6 +1108,11 @@ static umf_result_t trackingGetIpcHandle(void *provider, const void *ptr,
                 return ret;
             }
 
+            if (ipcDataSize > SIZE_MAX - sizeof(ipc_cache_value_t)) {
+                LOG_ERR("upstream provider IPC handle size is too large");
+                return UMF_RESULT_ERROR_INVALID_ARGUMENT;
+            }
+
             size_t value_size = sizeof(ipc_cache_value_t) + ipcDataSize;
             cache_value = umf_ba_global_alloc(value_size);
             if (!cache_value) {