mirror/glibc
2
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2024-11-27 03:41:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix integer overflow in malloc when tcache is enabled [BZ #22375]

Browse Source 
When the per-thread cache is enabled, __libc_malloc uses request2size (which
does not perform an overflow check) to calculate the chunk size from the
requested allocation size. This leads to an integer overflow causing malloc
to incorrectly return the last successfully allocated block when called with
a very large size argument (close to SIZE_MAX).

This commit uses checked_request2size instead, removing the overflow.
This commit is contained in:
Arjun Shankar 2017-11-30 13:31:45 +01:00
parent 18305fba55
commit 34697694e8
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-11-30 Arjun Shankar <arjun@redhat.com>
[BZ #22375]
* malloc/malloc.c (__libc_malloc): Use checked_request2size
instead of request2size.
2017-11-30 Joseph Myers <joseph@codesourcery.com>
* sysdeps/sparc/sparc32/sparcv9/fpu/multiarch/s_llrint.S

3
malloc/malloc.c
View File

@ -3031,7 +3031,8 @@ __libc_malloc (size_t bytes)
return (*hook)(bytes, RETURN_ADDRESS (0));
#if USE_TCACHE
/* int_free also calls request2size, be careful to not pad twice. */
size_t tbytes = request2size (bytes);
size_t tbytes;
checked_request2size (bytes, tbytes);
size_t tc_idx = csize2tidx (tbytes);
MAYBE_INIT_TCACHE ();