diff options
author | Florian Weimer <fw@deneb.enyo.de> | 2018-12-31 22:04:36 +0100 |
---|---|---|
committer | Florian Weimer <fw@deneb.enyo.de> | 2019-01-01 11:07:26 +0100 |
commit | 94417f6c26d6e6a2f0728b8e2cdacfb939689bce (patch) | |
tree | 2e5c5f889c9a3554d0e75afb6d2442326fca9357 | |
parent | a0bc5dd3bed4b04814047265b3bcead7ab973b87 (diff) | |
download | glibc-94417f6c26d6e6a2f0728b8e2cdacfb939689bce.tar.gz glibc-94417f6c26d6e6a2f0728b8e2cdacfb939689bce.tar.xz glibc-94417f6c26d6e6a2f0728b8e2cdacfb939689bce.zip |
malloc: Always call memcpy in _int_realloc [BZ #24027]
This commit removes the custom memcpy implementation from _int_realloc for small chunk sizes. The ncopies variable has the wrong type, and an integer wraparound could cause the existing code to copy too few elements (leaving the new memory region mostly uninitialized). Therefore, removing this code fixes bug 24027. (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | NEWS | 1 | ||||
-rw-r--r-- | malloc/malloc.c | 43 |
3 files changed, 9 insertions, 42 deletions
diff --git a/ChangeLog b/ChangeLog index 2d3af62685..b5727c7585 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2018-12-31 Florian Weimer <fw@deneb.enyo.de> + + [BZ #24027] + * malloc/malloc.c (_int_realloc): Always call memcpy for the + copying operation. (ncopies had the wrong type, resulting in an + integer wraparound and too few elements being copied.) + 2018-11-27 Florian Weimer <fweimer@redhat.com> [BZ #23927] diff --git a/NEWS b/NEWS index f6d26425ff..ef857b6e6c 100644 --- a/NEWS +++ b/NEWS @@ -163,6 +163,7 @@ The following bugs are resolved with this release: [23579] libc: Errors misreported in preadv2 [23709] Fix CPU string flags for Haswell-type CPUs [23927] Linux if_nametoindex() does not close descriptor (CVE-2018-19591) + [24027] malloc: Integer overflow in realloc Version 2.26 diff --git a/malloc/malloc.c b/malloc/malloc.c index 862337466e..49e8ed69c2 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -4528,11 +4528,6 @@ _int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize, mchunkptr bck; /* misc temp for linking */ mchunkptr fwd; /* misc temp for linking */ - unsigned long copysize; /* bytes to copy */ - unsigned int ncopies; /* INTERNAL_SIZE_T words to copy */ - INTERNAL_SIZE_T* s; /* copy source */ - INTERNAL_SIZE_T* d; /* copy destination */ - /* oldmem size */ if (__builtin_expect (chunksize_nomask (oldp) <= 2 * SIZE_SZ, 0) || __builtin_expect (oldsize >= av->system_mem, 0)) @@ -4600,43 +4595,7 @@ _int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize, } else { - /* - Unroll copy of <= 36 bytes (72 if 8byte sizes) - We know that contents have an odd number of - INTERNAL_SIZE_T-sized words; minimally 3. - */ - - copysize = oldsize - SIZE_SZ; - s = (INTERNAL_SIZE_T *) (chunk2mem (oldp)); - d = (INTERNAL_SIZE_T *) (newmem); - ncopies = copysize / sizeof (INTERNAL_SIZE_T); - assert (ncopies >= 3); - - if (ncopies > 9) - memcpy (d, s, copysize); - - else - { - *(d + 0) = *(s + 0); - *(d + 1) = *(s + 1); - *(d + 2) = *(s + 2); - if (ncopies > 4) - { - *(d + 3) = *(s + 3); - *(d + 4) = *(s + 4); - if (ncopies > 6) - { - *(d + 5) = *(s + 5); - *(d + 6) = *(s + 6); - if (ncopies > 8) - { - *(d + 7) = *(s + 7); - *(d + 8) = *(s + 8); - } - } - } - } - + memcpy (newmem, chunk2mem (oldp), oldsize - SIZE_SZ); _int_free (av, oldp, 1); check_inuse_chunk (av, newp); return chunk2mem (newp); |