diff options
| author | Florian Weimer <fweimer@redhat.com> | 2018-11-26 20:06:37 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2018-11-26 20:06:37 +0100 |
| commit | affec03b713c82c43a5b025dddc21bde3334f41e (patch) | |
| tree | 3026478268be021b7ba6d0d2650ce511cbf588b4 /ChangeLog | |
| parent | 8ae74eadb60eb36424e4605939cef5fc966724be (diff) | |
| download | glibc-affec03b713c82c43a5b025dddc21bde3334f41e.tar.gz glibc-affec03b713c82c43a5b025dddc21bde3334f41e.tar.xz glibc-affec03b713c82c43a5b025dddc21bde3334f41e.zip | |
malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]
The previous check could read beyond the end of the tcache entry array. If the e->key == tcache cookie check happened to pass, this would result in crashes.
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index 77fb773aea..84ddd68d7d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2018-11-26 Florian Weimer <fweimer@redhat.com> + + [BZ #23907] + * malloc/malloc.c (_int_free): Validate tc_idx before checking for + double-frees. + 2018-11-26 Rafael Ávila de Espíndola <rafael@espindo.la> [BZ #19767] |