Only service small allocations out of the mlock pool

2 files changed, 5 insertions, 2 deletions

diff --git a/src/alloc/locking_allocator/locking_allocator.cpp b/src/alloc/locking_allocator/locking_allocator.cpp
index 5d01eafb1..f00a1585a 100644
--- a/src/alloc/locking_allocator/locking_allocator.cpp
+++ b/src/alloc/locking_allocator/locking_allocator.cpp
@@ -77,8 +77,8 @@ void* mlock_allocator::allocate(size_t num_elems, size_t elem_size)
    if(n / elem_size != num_elems)
       return nullptr; // overflow!
 
-   if(n >= m_poolsize)
-      return nullptr; // bigger than the whole pool!
+   if(n > m_poolsize || n > BOTAN_MLOCK_ALLOCATOR_MAX_ALLOCATION)
+      return nullptr;
 
    std::lock_guard<std::mutex> lock(m_mutex);
 
diff --git a/src/build-data/buildh.in b/src/build-data/buildh.in
index faafb1ecd..81df9a32e 100644
--- a/src/build-data/buildh.in
+++ b/src/build-data/buildh.in
@@ -30,6 +30,9 @@
 /* How much to allocate for a buffer of no particular size */
 #define BOTAN_DEFAULT_BUFFER_SIZE 1024
 
+/* Maximum size to allocate out of the mlock pool */
+#define BOTAN_MLOCK_ALLOCATOR_MAX_ALLOCATION 4096
+
 /* Multiplier on a block cipher's native parallelism */
 #define BOTAN_BLOCK_CIPHER_PAR_MULT 4