Bug 22343 - Integer overflow in posix_memalign
Summary: Integer overflow in posix_memalign
Status: NEW
Alias: None
Product: glibc
Classification: Unclassified
Component: malloc (show other bugs)
Version: 2.26
: P3 minor
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2017-10-24 08:19 UTC by Florian Weimer
Modified: 2017-11-01 20:38 UTC (History)
1 user (show)

See Also:
Last reconfirmed:
fweimer: security+

reproducer.c (135 bytes, text/plain)
2017-10-24 08:19 UTC, Florian Weimer

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Weimer 2017-10-24 08:19:56 UTC
Created attachment 10553 [details]

Jakub Wilk reported that posix_memalign fails to properly report an error for allocation sizes close to SIZE_MAX:

Some posix_memalign() calls fail catastrophically:

  $ grep memalign test-posix-memalign.c
       return posix_memalign(&p, 0x10, SIZE_MAX - 0x20);

  $ make test-posix-memalign
  cc     test-posix-memalign.c   -o test-posix-memalign

  $ ./test-posix-memalign
  *** Error in `./test-posix-memalign': free(): invalid next size (fast): 0x57a96008 ***


#0  0xf7fd7dc9 in __kernel_vsyscall ()
#1  0xf7e2add0 in __libc_signal_restore_set (set=0xffffd160) at ../sysdeps/unix/sysv/linux/nptl-signals.h:79
#2  __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xf7e2c297 in __GI_abort () at abort.c:89
#4  0xf7e6638f in __libc_message (do_abort=<optimized out>, fmt=<optimized out>) at ../sysdeps/posix/libc_fatal.c:175
#5  0xf7e6cfc7 in malloc_printerr (action=<optimized out>, str=0xf7f60318 "free(): invalid next size (fast)", ptr=<optimized out>, ar_ptr=0xf7fb2780 <main_arena>) at malloc.c:5049
#6  0xf7e6d806 in _int_free (av=av@entry=0xf7fb2780 <main_arena>, p=p@entry=0x56558000, have_lock=have_lock@entry=1) at malloc.c:3905
#7  0xf7e6f8c3 in _int_memalign (av=av@entry=0xf7fb2780 <main_arena>, alignment=alignment@entry=16, bytes=bytes@entry=4294967263) at malloc.c:4497
#8  0xf7e70eea in _mid_memalign (alignment=16, bytes=4294967263, address=<optimized out>) at malloc.c:3158
#9  0xf7e71028 in _mid_memalign (alignment=alignment@entry=16, bytes=bytes@entry=4294967263, address=<optimized out>) at malloc.c:3121
#10 0xf7e72b7f in __posix_memalign (memptr=0xffffd6ac, alignment=16, size=4294967263) at malloc.c:5071
#11 0x5655556b in main ()