This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch master updated. glibc-2.26.9000-870-g3469769
- From: arjun at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 30 Nov 2017 12:50:46 -0000
- Subject: GNU C Library master sources branch master updated. glibc-2.26.9000-870-g3469769
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, master has been updated
via 34697694e8a93b325b18f25f7dcded55d6baeaf6 (commit)
from 18305fba5575a09063652014cfc483b898d8bdcd (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=34697694e8a93b325b18f25f7dcded55d6baeaf6
commit 34697694e8a93b325b18f25f7dcded55d6baeaf6
Author: Arjun Shankar <arjun@redhat.com>
Date: Thu Nov 30 13:31:45 2017 +0100
Fix integer overflow in malloc when tcache is enabled [BZ #22375]
When the per-thread cache is enabled, __libc_malloc uses request2size (which
does not perform an overflow check) to calculate the chunk size from the
requested allocation size. This leads to an integer overflow causing malloc
to incorrectly return the last successfully allocated block when called with
a very large size argument (close to SIZE_MAX).
This commit uses checked_request2size instead, removing the overflow.
diff --git a/ChangeLog b/ChangeLog
index b55ed22..888f9fb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-11-30 Arjun Shankar <arjun@redhat.com>
+
+ [BZ #22375]
+ * malloc/malloc.c (__libc_malloc): Use checked_request2size
+ instead of request2size.
+
2017-11-30 Joseph Myers <joseph@codesourcery.com>
* sysdeps/sparc/sparc32/sparcv9/fpu/multiarch/s_llrint.S
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 79f0e9e..0c9e074 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3031,7 +3031,8 @@ __libc_malloc (size_t bytes)
return (*hook)(bytes, RETURN_ADDRESS (0));
#if USE_TCACHE
/* int_free also calls request2size, be careful to not pad twice. */
- size_t tbytes = request2size (bytes);
+ size_t tbytes;
+ checked_request2size (bytes, tbytes);
size_t tc_idx = csize2tidx (tbytes);
MAYBE_INIT_TCACHE ();
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 6 ++++++
malloc/malloc.c | 3 ++-
2 files changed, 8 insertions(+), 1 deletions(-)
hooks/post-receive
--
GNU C Library master sources