From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1944) id DBDDD3857C7F; Fri, 19 Mar 2021 11:56:47 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DBDDD3857C7F Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Szabolcs Nagy To: glibc-cvs@sourceware.org Subject: [glibc/nsz/mtag] malloc: Fix a realloc crash with heap tagging [BZ 27468] X-Act-Checkin: glibc X-Git-Author: Szabolcs Nagy X-Git-Refname: refs/heads/nsz/mtag X-Git-Oldrev: 48593b505bca953901452cfd2fe117c9f4068a2b X-Git-Newrev: de2ed32e01d157f061bfd3f92314729af8ae2c8b Message-Id: <20210319115647.DBDDD3857C7F@sourceware.org> Date: Fri, 19 Mar 2021 11:56:47 +0000 (GMT) X-BeenThere: glibc-cvs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Mar 2021 11:56:48 -0000 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=de2ed32e01d157f061bfd3f92314729af8ae2c8b commit de2ed32e01d157f061bfd3f92314729af8ae2c8b Author: Szabolcs Nagy Date: Thu Feb 25 14:49:58 2021 +0000 malloc: Fix a realloc crash with heap tagging [BZ 27468] _int_free must be called with a chunk that has its tag reset. This was missing in a rare case that could crash when heap tagging is enabled: when in a multi-threaded process the current arena runs out of memory during realloc, but another arena still has space to finish the realloc then _int_free was called without clearing the user allocation tags. Fixes bug 27468. Reviewed-by: DJ Delorie Diff: --- malloc/malloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/malloc/malloc.c b/malloc/malloc.c index 1f4bbd8edf..8f8f12c276 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3446,7 +3446,9 @@ __libc_realloc (void *oldmem, size_t bytes) newp = __libc_malloc (bytes); if (newp != NULL) { - memcpy (newp, oldmem, oldsize - SIZE_SZ); + size_t sz = CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ; + memcpy (newp, oldmem, sz); + (void) TAG_REGION (chunk2rawmem (oldp), sz); _int_free (ar_ptr, oldp, 0); } }