diff options
author | Arjun Shankar <arjun.is@lostca.se> | 2018-01-18 16:47:06 +0000 |
---|---|---|
committer | Arjun Shankar <arjun@redhat.com> | 2018-01-18 17:55:45 +0100 |
commit | 8e448310d74b283c5cd02b9ed7fb997b47bf9b22 (patch) | |
tree | a5cb99be6773177cf14683cbf10ecbc34a7dc82c /ChangeLog | |
parent | 80647883cf5847c8b6b0197e9703eb04222496b6 (diff) | |
download | glibc-8e448310d74b283c5cd02b9ed7fb997b47bf9b22.tar.gz glibc-8e448310d74b283c5cd02b9ed7fb997b47bf9b22.tar.xz glibc-8e448310d74b283c5cd02b9ed7fb997b47bf9b22.zip |
Fix integer overflows in internal memalign and malloc functions [BZ #22343]
When posix_memalign is called with an alignment less than MALLOC_ALIGNMENT and a requested size close to SIZE_MAX, it falls back to malloc code (because the alignment of a block returned by malloc is sufficient to satisfy the call). In this case, an integer overflow in _int_malloc leads to posix_memalign incorrectly returning successfully. Upon fixing this and writing a somewhat thorough regression test, it was discovered that when posix_memalign is called with an alignment larger than MALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size close to SIZE_MAX, a different integer overflow in _int_memalign leads to posix_memalign incorrectly returning successfully. Both integer overflows affect other memory allocation functions that use _int_malloc (one affected malloc in x86) or _int_memalign as well. This commit fixes both integer overflows. In addition to this, it adds a regression test to guard against false successful allocations by the following memory allocation functions when called with too-large allocation sizes and, where relevant, various valid alignments: malloc, realloc, calloc, reallocarray, memalign, posix_memalign, aligned_alloc, valloc, and pvalloc.
Diffstat (limited to 'ChangeLog')
-rw-r--r-- | ChangeLog | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index 5f6d1ce2b0..fbd73e34a5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +2018-01-18 Arjun Shankar <arjun@redhat.com> + + [BZ #22343] + * malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE + after padding. + (_int_memalign): check for integer overflow before calling + _int_malloc. + * malloc/tst-malloc-too-large.c: New test. + * malloc/Makefile: Add tst-malloc-too-large. + 2018-01-18 Rafal Luzynski <digitalfreak@lingonborough.com> * localedata/locales/bho_NP (LC_IDENTIFICATION): Fix an obvious typo |