[RFC][PATCH 5/7] malloc: Verify the integrity of mmapped chunks in calloc.

[Istvan Kurucsai <pistukem at gmail dot com>]

    * malloc/malloc.c (__libc_calloc): Check mmapped chunks.
---
 malloc/malloc.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 424c69d..f0c54fa 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3260,6 +3260,19 @@ __libc_calloc (size_t n, size_t elem_size)
   /* Two optional cases in which clearing not necessary */
   if (chunk_is_mmapped (p))
     {
+      size_t pagesize = GLRO (dl_pagesize);
+      INTERNAL_SIZE_T offset = prev_size (p);
+      INTERNAL_SIZE_T size = chunksize (p);
+      uintptr_t block = (uintptr_t) p - offset;
+      size_t total_size = offset + size;
+      if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+          || __glibc_unlikely (!powerof2 ((uintptr_t) mem & (pagesize - 1))))
+        {
+          malloc_printerr (check_action, "calloc(): invalid mmapped chunk",
+                           chunk2mem (p), NULL);
+          return 0;
+        }
+
       if (__builtin_expect (perturb_byte, 0))
         return memset (mem, 0, sz);
 
-- 
2.7.4