[Bug libc/22375] New: malloc returns pointer from tcache_get when should return NULL

["ibuclaw at gdcproject dot org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22375

            Bug ID: 22375
           Summary: malloc returns pointer from tcache_get when should
                    return NULL
           Product: glibc
           Version: 2.26
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: ibuclaw at gdcproject dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

---
#include <assert.h>
#include <stdlib.h>

int main()
{
  void* x = malloc(10);            // normal allocation
  assert(x != NULL);               // allocation should succeed
  free(x);

  void* z = malloc(((size_t)~0) - 2); // overflow allocation (size_t.max-2)
  assert(z == NULL);                  // allocation should fail
}
---

The second call to malloc returns the cached pointer originally allocated for
'x'.  But should return NULL.

-- 
You are receiving this mail because:
You are on the CC list for the bug.