This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/22375] malloc returns pointer from tcache_get when should return NULL (CVE-2017-17426)
- From: "cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sourceware dot org
- Date: Wed, 06 Dec 2017 06:58:20 +0000
- Subject: [Bug libc/22375] malloc returns pointer from tcache_get when should return NULL (CVE-2017-17426)
- Auto-submitted: auto-generated
- References: <bug-22375-131@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=22375
--- Comment #10 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, release/2.26/master has been updated
via df8c219cb987cfe85c550efa693a1383a11e38aa (commit)
from 0890d5379cac9b7e2a5f09c3647ebad235c1442d (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=df8c219cb987cfe85c550efa693a1383a11e38aa
commit df8c219cb987cfe85c550efa693a1383a11e38aa
Author: Arjun Shankar <arjun@redhat.com>
Date: Thu Nov 30 13:31:45 2017 +0100
Fix integer overflow in malloc when tcache is enabled [BZ #22375]
When the per-thread cache is enabled, __libc_malloc uses request2size
(which
does not perform an overflow check) to calculate the chunk size from the
requested allocation size. This leads to an integer overflow causing malloc
to incorrectly return the last successfully allocated block when called
with
a very large size argument (close to SIZE_MAX).
This commit uses checked_request2size instead, removing the overflow.
(cherry picked from commit 34697694e8a93b325b18f25f7dcded55d6baeaf6)
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 7 +++++++
NEWS | 6 ++++++
malloc/malloc.c | 3 ++-
3 files changed, 15 insertions(+), 1 deletions(-)
--
You are receiving this mail because:
You are on the CC list for the bug.