* [PATCH 0/1] Fix null-pointer dereference in nano-malloc
@ 2022-01-25 15:44 Cyril Yared
2022-01-25 15:44 ` [PATCH 1/1] " Cyril Yared
0 siblings, 1 reply; 3+ messages in thread
From: Cyril Yared @ 2022-01-25 15:44 UTC (permalink / raw)
To: newlib; +Cc: Cyril Yared
Commit 84d068971 introduced a null-pointer dereference in
nano-malloc when the following two conditions are met:
1). The free_list has no items (= NULL).
2). The call to sbrk_aligned returns -1 (failure).
On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:
if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{
If the two conditions are met, then p = free_list = NULL so p->size will be
a null-pointer dereference.
Cyril Yared (1):
Fix a potential null-pointer dereference in nano-malloc when calling
malloc() while the free_list is empty and the call to sbrk_aligned
fails.
newlib/libc/stdlib/nano-mallocr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--
2.21.0 (Apple Git-122.2)
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/1] Fix null-pointer dereference in nano-malloc
2022-01-25 15:44 [PATCH 0/1] Fix null-pointer dereference in nano-malloc Cyril Yared
@ 2022-01-25 15:44 ` Cyril Yared
2022-01-26 12:14 ` Corinna Vinschen
0 siblings, 1 reply; 3+ messages in thread
From: Cyril Yared @ 2022-01-25 15:44 UTC (permalink / raw)
To: newlib; +Cc: Cyril Yared
If p is NULL, then the free_list is empty and we should return the
correct failure values.
---
newlib/libc/stdlib/nano-mallocr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
index 6fb08a616..0c5fb2885 100644
--- a/newlib/libc/stdlib/nano-mallocr.c
+++ b/newlib/libc/stdlib/nano-mallocr.c
@@ -322,7 +322,7 @@ void * nano_malloc(RARG malloc_size_t s)
r=r->next;
}
- if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
+ if (p != NULL && (char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{
/* The last free item has the heap end as neighbour.
* Let's ask for a smaller amount and merge */
--
2.21.0 (Apple Git-122.2)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] Fix null-pointer dereference in nano-malloc
2022-01-25 15:44 ` [PATCH 1/1] " Cyril Yared
@ 2022-01-26 12:14 ` Corinna Vinschen
0 siblings, 0 replies; 3+ messages in thread
From: Corinna Vinschen @ 2022-01-26 12:14 UTC (permalink / raw)
To: newlib
On Jan 25 07:44, Cyril Yared wrote:
> If p is NULL, then the free_list is empty and we should return the
> correct failure values.
> ---
> newlib/libc/stdlib/nano-mallocr.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
> index 6fb08a616..0c5fb2885 100644
> --- a/newlib/libc/stdlib/nano-mallocr.c
> +++ b/newlib/libc/stdlib/nano-mallocr.c
> @@ -322,7 +322,7 @@ void * nano_malloc(RARG malloc_size_t s)
> r=r->next;
> }
>
> - if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
> + if (p != NULL && (char *)p + p->size == (char *)_SBRK_R(RCALL 0))
> {
> /* The last free item has the heap end as neighbour.
> * Let's ask for a smaller amount and merge */
> --
> 2.21.0 (Apple Git-122.2)
Pushed.
Thanks,
Corinna
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-01-26 12:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-25 15:44 [PATCH 0/1] Fix null-pointer dereference in nano-malloc Cyril Yared
2022-01-25 15:44 ` [PATCH 1/1] " Cyril Yared
2022-01-26 12:14 ` Corinna Vinschen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).