diff options
| author | Istvan Kurucsai <pistukem@gmail.com> | 2018-12-20 23:30:07 -0500 |
|---|---|---|
| committer | DJ Delorie <dj@delorie.com> | 2018-12-20 23:31:37 -0500 |
| commit | ebe544bf6e8eec35e754fd49efb027c6f161b6cb (patch) | |
| tree | 6cab1e7bf56a69968d5ece9678dbb9676a830990 | |
| parent | 5f72b00591ce4d1b4c0418294ffe1623983d5679 (diff) | |
| download | glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.tar.gz glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.tar.xz glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.zip | |
malloc: Add more integrity checks to mremap_chunk.
* malloc/malloc.c (mremap_chunk): Additional checks.
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | malloc/malloc.c | 12 |
2 files changed, 13 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog index e7d231adcb..ff9349f4e3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +2018-12-20 Istvan Kurucsai <pistukem@gmail.com> + + * malloc/malloc.c (mremap_chunk): Additional checks. + 2018-12-21 Mao Han <han_mao@c-sky.com> * config.h.in (CSKYABI, CSKY_HARD_FLOAT): New Define. diff --git a/malloc/malloc.c b/malloc/malloc.c index c9b2c6e320..32d47f083c 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -2928,16 +2928,22 @@ mremap_chunk (mchunkptr p, size_t new_size) char *cp; assert (chunk_is_mmapped (p)); - assert (((size + offset) & (GLRO (dl_pagesize) - 1)) == 0); + + uintptr_t block = (uintptr_t) p - offset; + uintptr_t mem = (uintptr_t) chunk2mem(p); + size_t total_size = offset + size; + if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0 + || __glibc_unlikely (!powerof2 (mem & (pagesize - 1)))) + malloc_printerr("mremap_chunk(): invalid pointer"); /* Note the extra SIZE_SZ overhead as in mmap_chunk(). */ new_size = ALIGN_UP (new_size + offset + SIZE_SZ, pagesize); /* No need to remap if the number of pages does not change. */ - if (size + offset == new_size) + if (total_size == new_size) return p; - cp = (char *) __mremap ((char *) p - offset, size + offset, new_size, + cp = (char *) __mremap ((char *) block, total_size, new_size, MREMAP_MAYMOVE); if (cp == MAP_FAILED) |