[PATCH 0/1] Fix null-pointer dereference in nano-malloc

[PATCH 0/1] Fix null-pointer dereference in nano-malloc

[Cyril Yared]

Commit 84d068971 introduced a null-pointer dereference in
nano-malloc when the following two conditions are met:

1). The free_list has no items (= NULL).
2). The call to sbrk_aligned returns -1 (failure).

On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:

if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{

If the two conditions are met, then p = free_list = NULL so p->size will be
a null-pointer dereference.

Cyril Yared (1):
  Fix a potential null-pointer dereference in nano-malloc when calling
    malloc() while the free_list is empty and the call to sbrk_aligned
    fails.

 newlib/libc/stdlib/nano-mallocr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.21.0 (Apple Git-122.2)

[PATCH 1/1] Fix null-pointer dereference in nano-malloc

[Cyril Yared]

If p is NULL, then the free_list is empty and we should return the
correct failure values.
---
 newlib/libc/stdlib/nano-mallocr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
index 6fb08a616..0c5fb2885 100644
--- a/newlib/libc/stdlib/nano-mallocr.c
+++ b/newlib/libc/stdlib/nano-mallocr.c
@@ -322,7 +322,7 @@ void * nano_malloc(RARG malloc_size_t s)
                 r=r->next;
             }
 
-            if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
+            if (p != NULL && (char *)p + p->size == (char *)_SBRK_R(RCALL 0))
             {
                /* The last free item has the heap end as neighbour.
                 * Let's ask for a smaller amount and merge */
-- 
2.21.0 (Apple Git-122.2)

Re: [PATCH 1/1] Fix null-pointer dereference in nano-malloc

[Corinna Vinschen]

On Jan 25 07:44, Cyril Yared wrote:
> If p is NULL, then the free_list is empty and we should return the
> correct failure values.
> ---
>  newlib/libc/stdlib/nano-mallocr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
> index 6fb08a616..0c5fb2885 100644
> --- a/newlib/libc/stdlib/nano-mallocr.c
> +++ b/newlib/libc/stdlib/nano-mallocr.c
> @@ -322,7 +322,7 @@ void * nano_malloc(RARG malloc_size_t s)
>                  r=r->next;
>              }
>  
> -            if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
> +            if (p != NULL && (char *)p + p->size == (char *)_SBRK_R(RCALL 0))
>              {
>                 /* The last free item has the heap end as neighbour.
>                  * Let's ask for a smaller amount and merge */
> -- 
> 2.21.0 (Apple Git-122.2)

Pushed.


Thanks,
Corinna