* Null-pointer dereference bug in nano-malloc
@ 2022-01-25 6:04 Cyril Yared
2022-01-25 12:35 ` Corinna Vinschen
0 siblings, 1 reply; 2+ messages in thread
From: Cyril Yared @ 2022-01-25 6:04 UTC (permalink / raw)
To: newlib
Hi,
It appears that commit 84d068971 introduced a null-pointer dereference in
nano-malloc when the following two conditions are met:
1). The free_list has no items (= NULL).
2). The call to sbrk_aligned returns -1 (failure).
On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:
if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{
If the two conditions are met, then p = free_list = NULL so p->size will be
a null-pointer dereference. Is this something that's known/being tracked
anywhere?
Cyril
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Null-pointer dereference bug in nano-malloc
2022-01-25 6:04 Null-pointer dereference bug in nano-malloc Cyril Yared
@ 2022-01-25 12:35 ` Corinna Vinschen
0 siblings, 0 replies; 2+ messages in thread
From: Corinna Vinschen @ 2022-01-25 12:35 UTC (permalink / raw)
To: newlib; +Cc: Cyril Yared
On Jan 24 22:04, Cyril Yared wrote:
> Hi,
> It appears that commit 84d068971 introduced a null-pointer dereference in
> nano-malloc when the following two conditions are met:
>
> 1). The free_list has no items (= NULL).
> 2). The call to sbrk_aligned returns -1 (failure).
>
> On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:
>
> if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
> {
>
> If the two conditions are met, then p = free_list = NULL so p->size will be
> a null-pointer dereference. Is this something that's known/being tracked
> anywhere?
I don't think so. Just send a patch, please.
Corinna
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-01-25 12:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-25 6:04 Null-pointer dereference bug in nano-malloc Cyril Yared
2022-01-25 12:35 ` Corinna Vinschen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).