This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[RFC][PATCH 1/7] malloc: Add check for top size corruption.
- From: Istvan Kurucsai <pistukem at gmail dot com>
- To: libc-alpha at sourceware dot org
- Cc: Istvan Kurucsai <pistukem at gmail dot com>
- Date: Wed, 31 May 2017 10:43:49 +0200
- Subject: [RFC][PATCH 1/7] malloc: Add check for top size corruption.
- Authentication-results: sourceware.org; auth=none
- References: <1496220235-12750-1-git-send-email-pistukem@gmail.com>
Ensure that the size of top is below av->system_mem.
* malloc/malloc.c (_int_malloc): Check top size.
---
malloc/malloc.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index aa45626..458b57d 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3801,6 +3801,13 @@ _int_malloc (mstate av, size_t bytes)
if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
{
+ if (__glibc_unlikely ((unsigned long) (size) >
+ (unsigned long) (av->system_mem)))
+ {
+ errstr = "malloc(): corrupted top chunk";
+ goto errout;
+ }
+
remainder_size = size - nb;
remainder = chunk_at_offset (victim, nb);
av->top = remainder;
--
2.7.4