[Bug libc/16038] New: A very large alignment value causes memalign/posix_memalign to loop forever

[Bug libc/16038] New: A very large alignment value causes memalign/posix_memalign to loop forever

[will.newton at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16038

            Bug ID: 16038
           Summary: A very large alignment value causes
                    memalign/posix_memalign to loop forever
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: will.newton at gmail dot com
                CC: drepper.fsp at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16038] A very large alignment value causes memalign/posix_memalign to loop forever

[will.newton at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16038

--- Comment #1 from Will Newton <will.newton at gmail dot com> ---

Passing a very large value for the alignment parameter of
memalign/posix_memalign causes _int_memalign to enter an infinite loop, e.g.:

memalign(-1, 0x1000);

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16038] A very large alignment value causes memalign/posix_memalign to loop forever

[cvs-commit at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=16038

--- Comment #2 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
       via  a56ee40b176d0a3f47f2a7eb75208f2e3763c9fd (commit)
      from  c6e4925d4069d38843c02994ffd284e8c87c8929 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a56ee40b176d0a3f47f2a7eb75208f2e3763c9fd

commit a56ee40b176d0a3f47f2a7eb75208f2e3763c9fd
Author: Will Newton <will.newton@linaro.org>
Date:   Thu Oct 10 13:17:13 2013 +0100

    malloc: Fix for infinite loop in memalign/posix_memalign.

    A very large alignment argument passed to mealign/posix_memalign
    causes _int_memalign to enter an infinite loop. Limit the maximum
    alignment value to the maximum representable power of two to
    prevent this from happening.

    Changelog:

    2013-10-30  Will Newton  <will.newton@linaro.org>

        [BZ #16038]
        * malloc/hooks.c (memalign_check): Limit alignment to the
        maximum representable power of two.
        * malloc/malloc.c (__libc_memalign): Likewise.
        * malloc/tst-memalign.c (do_test): Add test for very
        large alignment values.
        * malloc/tst-posix_memalign.c (do_test): Likewise.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                   |   10 ++++++++++
 malloc/hooks.c              |    8 ++++++++
 malloc/malloc.c             |    8 ++++++++
 malloc/tst-memalign.c       |   15 +++++++++++++++
 malloc/tst-posix_memalign.c |   10 ++++++++++
 5 files changed, 51 insertions(+), 0 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16038] A very large alignment value causes memalign/posix_memalign to loop forever

[will.newton at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16038

Will Newton <will.newton at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Will Newton <will.newton at gmail dot com> ---

Fixed in a56ee40b176d0a3f47f2a7eb75208f2e3763c9fd.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/16038] A very large alignment value causes memalign/posix_memalign to loop forever

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16038

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #4 from Florian Weimer <fweimer at redhat dot com> ---
The alignment should come from a trusted source, so this does not cross a trust
boundary and is not a security vulnerability.

-- 
You are receiving this mail because:
You are on the CC list for the bug.