From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 1944) id 894D43858D28; Mon, 19 Dec 2022 15:31:40 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 894D43858D28 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1671463900; bh=gx/Au2BZdP4paTPfwa/EBBdmk8Du790qBG2twVA2NgM=; h=From:To:Subject:Date:From; b=NKrabMykFK7pctgyTmGuud1uZcd/Ph6tKZ92wucxM4anyB5+MNXIior3v3AwZglNK rTwEkT3Kv/AyaKE6HShS6j4CR+XJ8NPIVttQINVElGOjpPmpoeInbUGKeDywalkkKw qNBWPMVbDs9lpAwXp2Qkhx7IPZq4ubCejMQUKgyM= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Szabolcs Nagy To: glibc-cvs@sourceware.org Subject: [glibc/arm/morello/main] cheri: malloc: Fix realloc to copy all relevant bytes X-Act-Checkin: glibc X-Git-Author: Szabolcs Nagy X-Git-Refname: refs/heads/arm/morello/main X-Git-Oldrev: dc23cc80210799f8d8ab5b1ea2e00341e613a1a7 X-Git-Newrev: bbce0c75f35f55b9f5e43dd4fa01a82cc27bf020 Message-Id: <20221219153140.894D43858D28@sourceware.org> Date: Mon, 19 Dec 2022 15:31:40 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bbce0c75f35f55b9f5e43dd4fa01a82cc27bf020 commit bbce0c75f35f55b9f5e43dd4fa01a82cc27bf020 Author: Szabolcs Nagy Date: Mon Dec 19 13:18:10 2022 +0000 cheri: malloc: Fix realloc to copy all relevant bytes New code in realloc that handles when new allocation is needed for alignment reasons (for capability narrowing) used the wrong size in memcpy (size was off by SIZE_SZ unless memory tagging was enabled) and used wrongly tagged pointer for untagging the old memory. Due to this bug realloc sometimes failed to copy tail bytes of an old allocation to the new allocation when capability narrowing is enabled. Diff: --- malloc/malloc.c | 4 ++-- malloc/tst-realloc.c | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/malloc/malloc.c b/malloc/malloc.c index 392116a5ac..ededc5cfe2 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3762,9 +3762,9 @@ __libc_realloc (void *oldmem, size_t bytes) void *newmem = _mid_memalign (align, bytes, 0); if (!cap_narrow_check (newmem, oldmem)) return newmem; - size_t sz = oldsize - CHUNK_HDR_SZ; + size_t sz = memsize (oldp); memcpy (newmem, oldmem, sz < bytes ? sz : bytes); - (void) tag_region (oldmem, sz); + (void) tag_region (chunk2mem (oldp), sz); _int_free (ar_ptr, oldp, 0); return newmem; } diff --git a/malloc/tst-realloc.c b/malloc/tst-realloc.c index 5eb62a770f..2e14d318ab 100644 --- a/malloc/tst-realloc.c +++ b/malloc/tst-realloc.c @@ -83,6 +83,25 @@ do_test (void) free (p); + /* Check as above with larger size increase. */ + p = malloc (34); + if (p == NULL) + FAIL_EXIT1 ("malloc (34) failed."); + memset (p, 'a', 34); + p = realloc (p, 80000); + if (p == NULL) + FAIL_EXIT1 ("realloc (p, 80000) failed."); + c = p; + ok = 1; + for (i = 0; i < 34; i++) + { + if (c[i] != 'a') + ok = 0; + } + if (ok == 0) + FAIL_EXIT1 ("first 34 bytes were not preserved"); + free (p); + p = realloc (NULL, 100); if (p == NULL) FAIL_EXIT1 ("realloc (NULL, 100) failed.");