about summary refs log tree commit diff
path: root/malloc
diff options
context:
space:
mode:
authorWill Newton <will.newton@linaro.org>2013-10-09 14:41:57 +0100
committerWill Newton <will.newton@linaro.org>2013-10-10 14:52:05 +0100
commit321e26847188300173a5dc0ca42c2ff7b9bf7a78 (patch)
tree24b26956b40116bf12a2c6414444b42a14ef243a /malloc
parent40fefba1b5b05d05a3a4b48796a1006db90d8f74 (diff)
downloadglibc-321e26847188300173a5dc0ca42c2ff7b9bf7a78.tar.gz
glibc-321e26847188300173a5dc0ca42c2ff7b9bf7a78.tar.xz
glibc-321e26847188300173a5dc0ca42c2ff7b9bf7a78.zip
malloc/hooks.c: Correct check for overflow in memalign_check.
A large value of bytes passed to memalign_check can cause an integer
overflow in _int_memalign and heap corruption. This issue can be
exposed by running tst-memalign with MALLOC_CHECK_=3.

ChangeLog:

2013-10-10  Will Newton  <will.newton@linaro.org>

	* malloc/hooks.c (memalign_check): Ensure the value of bytes
	passed to _int_memalign does not overflow.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/hooks.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/malloc/hooks.c b/malloc/hooks.c
index 8c25846330..3f663bb6b2 100644
--- a/malloc/hooks.c
+++ b/malloc/hooks.c
@@ -361,10 +361,13 @@ memalign_check(size_t alignment, size_t bytes, const void *caller)
   if (alignment <= MALLOC_ALIGNMENT) return malloc_check(bytes, NULL);
   if (alignment <  MINSIZE) alignment = MINSIZE;
 
-  if (bytes+1 == 0) {
-    __set_errno (ENOMEM);
-    return NULL;
-  }
+  /* Check for overflow.  */
+  if (bytes > SIZE_MAX - alignment - MINSIZE)
+    {
+      __set_errno (ENOMEM);
+      return 0;
+    }
+
   (void)mutex_lock(&main_arena.mutex);
   mem = (top_check() >= 0) ? _int_memalign(&main_arena, alignment, bytes+1) :
     NULL;