From 34697694e8a93b325b18f25f7dcded55d6baeaf6 Mon Sep 17 00:00:00 2001 From: Arjun Shankar Date: Thu, 30 Nov 2017 13:31:45 +0100 Subject: [PATCH] Fix integer overflow in malloc when tcache is enabled [BZ #22375] When the per-thread cache is enabled, __libc_malloc uses request2size (which does not perform an overflow check) to calculate the chunk size from the requested allocation size. This leads to an integer overflow causing malloc to incorrectly return the last successfully allocated block when called with a very large size argument (close to SIZE_MAX). This commit uses checked_request2size instead, removing the overflow. --- ChangeLog | 6 ++++++ malloc/malloc.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index b55ed22f32..888f9fbd67 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2017-11-30 Arjun Shankar + + [BZ #22375] + * malloc/malloc.c (__libc_malloc): Use checked_request2size + instead of request2size. + 2017-11-30 Joseph Myers * sysdeps/sparc/sparc32/sparcv9/fpu/multiarch/s_llrint.S diff --git a/malloc/malloc.c b/malloc/malloc.c index 79f0e9eac7..0c9e0748b4 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3031,7 +3031,8 @@ __libc_malloc (size_t bytes) return (*hook)(bytes, RETURN_ADDRESS (0)); #if USE_TCACHE /* int_free also calls request2size, be careful to not pad twice. */ - size_t tbytes = request2size (bytes); + size_t tbytes; + checked_request2size (bytes, tbytes); size_t tc_idx = csize2tidx (tbytes); MAYBE_INIT_TCACHE ();