* [2.28 COMMITTED] malloc: Check the alignment of mmapped chunks before unmapping.
@ 2019-01-01 0:00 Arjun Shankar
0 siblings, 0 replies; only message in thread
From: Arjun Shankar @ 2019-01-01 0:00 UTC (permalink / raw)
To: libc-stable
* malloc/malloc.c (munmap_chunk): Verify chunk alignment.
(cherry picked from commit c0e82f117357a941e4d40fcc08babbd6a3c3a1b5)
---
ChangeLog | 4 ++++
malloc/malloc.c | 5 ++++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/ChangeLog b/ChangeLog
index e2d7e3caca..c9448acfdd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-12-21 Istvan Kurucsai <pistukem@gmail.com>
+
+ * malloc/malloc.c (munmap_chunk): Verify chunk alignment.
+
2018-12-20 Istvan Kurucsai <pistukem@gmail.com>
* malloc/malloc.c (mremap_chunk): Additional checks.
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 7880fcd1c3..6ae22e61dc 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2810,6 +2810,7 @@ systrim (size_t pad, mstate av)
static void
munmap_chunk (mchunkptr p)
{
+ size_t pagesize = GLRO (dl_pagesize);
INTERNAL_SIZE_T size = chunksize (p);
assert (chunk_is_mmapped (p));
@@ -2819,6 +2820,7 @@ munmap_chunk (mchunkptr p)
if (DUMPED_MAIN_ARENA_CHUNK (p))
return;
+ uintptr_t mem = (uintptr_t) chunk2mem (p);
uintptr_t block = (uintptr_t) p - prev_size (p);
size_t total_size = prev_size (p) + size;
/* Unfortunately we have to do the compilers job by hand here. Normally
@@ -2826,7 +2828,8 @@ munmap_chunk (mchunkptr p)
page size. But gcc does not recognize the optimization possibility
(in the moment at least) so we combine the two values into one before
the bit test. */
- if (__builtin_expect (((block | total_size) & (GLRO (dl_pagesize) - 1)) != 0, 0))
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+ || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
malloc_printerr ("munmap_chunk(): invalid pointer");
atomic_decrement (&mp_.n_mmaps);
--
2.20.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-05-02 12:43 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-01 0:00 [2.28 COMMITTED] malloc: Check the alignment of mmapped chunks before unmapping Arjun Shankar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).