diff options
author | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2021-02-25 14:49:58 +0000 |
---|---|---|
committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2021-03-26 10:43:51 +0000 |
commit | 42cc96066b22ba065db11096c78881a55e45def4 (patch) | |
tree | 806136a0e5fe76b6e811810f6626a11753260dca /malloc/malloc.c | |
parent | 7759be2593b689cb1eafc0f52ee7f59c639e5d2f (diff) | |
download | glibc-42cc96066b22ba065db11096c78881a55e45def4.tar.gz glibc-42cc96066b22ba065db11096c78881a55e45def4.tar.xz glibc-42cc96066b22ba065db11096c78881a55e45def4.zip |
malloc: Fix a realloc crash with heap tagging [BZ 27468]
_int_free must be called with a chunk that has its tag reset. This was missing in a rare case that could crash when heap tagging is enabled: when in a multi-threaded process the current arena runs out of memory during realloc, but another arena still has space to finish the realloc then _int_free was called without clearing the user allocation tags. Fixes bug 27468. Reviewed-by: DJ Delorie <dj@redhat.com>
Diffstat (limited to 'malloc/malloc.c')
-rw-r--r-- | malloc/malloc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c index 530c792997..9d9f7b918a 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3446,7 +3446,9 @@ __libc_realloc (void *oldmem, size_t bytes) newp = __libc_malloc (bytes); if (newp != NULL) { - memcpy (newp, oldmem, oldsize - SIZE_SZ); + size_t sz = CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ; + memcpy (newp, oldmem, sz); + (void) TAG_REGION (chunk2rawmem (oldp), sz); _int_free (ar_ptr, oldp, 0); } } |