This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[PATCH v2 7/7] malloc: Check the alignment of mmapped chunks before unmapping.
- From: Istvan Kurucsai <pistukem at gmail dot com>
- To: libc-alpha at sourceware dot org
- Cc: Istvan Kurucsai <pistukem at gmail dot com>
- Date: Tue, 7 Nov 2017 16:27:10 +0100
- Subject: [PATCH v2 7/7] malloc: Check the alignment of mmapped chunks before unmapping.
- Authentication-results: sourceware.org; auth=none
- References: <1510068430-27816-1-git-send-email-pistukem@gmail.com>
* malloc/malloc.c (munmap_chunk): Verify chunk alignment.
---
malloc/malloc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 1a2ba04..0df4f14 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2819,6 +2819,7 @@ systrim (size_t pad, mstate av)
static void
munmap_chunk (mchunkptr p)
{
+ size_t pagesize = GLRO (dl_pagesize);
INTERNAL_SIZE_T size = chunksize (p);
assert (chunk_is_mmapped (p));
@@ -2828,6 +2829,7 @@ munmap_chunk (mchunkptr p)
if (DUMPED_MAIN_ARENA_CHUNK (p))
return;
+ uintptr_t mem = (uintptr_t) chunk2mem(p);
uintptr_t block = (uintptr_t) p - prev_size (p);
size_t total_size = prev_size (p) + size;
/* Unfortunately we have to do the compilers job by hand here. Normally
@@ -2835,7 +2837,8 @@ munmap_chunk (mchunkptr p)
page size. But gcc does not recognize the optimization possibility
(in the moment at least) so we combine the two values into one before
the bit test. */
- if (__builtin_expect (((block | total_size) & (GLRO (dl_pagesize) - 1)) != 0, 0))
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+ || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
malloc_printerr ("munmap_chunk(): invalid pointer");
atomic_decrement (&mp_.n_mmaps);
--
2.7.4