This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch release/2.25/master updated. glibc-2.25-130-g6b95c49
- From: fw at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 1 Jan 2019 10:05:51 -0000
- Subject: GNU C Library master sources branch release/2.25/master updated. glibc-2.25-130-g6b95c49
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, release/2.25/master has been updated
via 6b95c49d8e2b0bea8b2edcf13827e37e477fb19e (commit)
from 7118ba34931d27f538c71c1cd355866f8db83f4e (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=6b95c49d8e2b0bea8b2edcf13827e37e477fb19e
commit 6b95c49d8e2b0bea8b2edcf13827e37e477fb19e
Author: Florian Weimer <fw@deneb.enyo.de>
Date: Mon Dec 31 22:04:36 2018 +0100
malloc: Always call memcpy in _int_realloc [BZ #24027]
This commit removes the custom memcpy implementation from _int_realloc
for small chunk sizes. The ncopies variable has the wrong type, and
an integer wraparound could cause the existing code to copy too few
elements (leaving the new memory region mostly uninitialized).
Therefore, removing this code fixes bug 24027.
(cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)
diff --git a/ChangeLog b/ChangeLog
index 043e589..4295c42 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2018-12-31 Florian Weimer <fw@deneb.enyo.de>
+
+ [BZ #24027]
+ * malloc/malloc.c (_int_realloc): Always call memcpy for the
+ copying operation. (ncopies had the wrong type, resulting in an
+ integer wraparound and too few elements being copied.)
+
2018-09-06 Stefan Liebler <stli@linux.ibm.com>
* sysdeps/unix/sysv/linux/spawni.c (maybe_script_execute):
diff --git a/NEWS b/NEWS
index abe90d1..ac22222 100644
--- a/NEWS
+++ b/NEWS
@@ -85,6 +85,7 @@ The following bugs are resolved with this release:
[22715] x86-64: Properly align La_x86_64_retval to VEC_SIZE
[22774] malloc: Integer overflow in malloc (CVE-2018-6551)
[23538] pthread_cond_broadcast: Fix waiters-after-spinning case
+ [24027] malloc: Integer overflow in realloc
Version 2.25
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 0686e5d..5cbdaef 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4250,11 +4250,6 @@ _int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize,
mchunkptr bck; /* misc temp for linking */
mchunkptr fwd; /* misc temp for linking */
- unsigned long copysize; /* bytes to copy */
- unsigned int ncopies; /* INTERNAL_SIZE_T words to copy */
- INTERNAL_SIZE_T* s; /* copy source */
- INTERNAL_SIZE_T* d; /* copy destination */
-
const char *errstr = NULL;
/* oldmem size */
@@ -4332,43 +4327,7 @@ _int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize,
}
else
{
- /*
- Unroll copy of <= 36 bytes (72 if 8byte sizes)
- We know that contents have an odd number of
- INTERNAL_SIZE_T-sized words; minimally 3.
- */
-
- copysize = oldsize - SIZE_SZ;
- s = (INTERNAL_SIZE_T *) (chunk2mem (oldp));
- d = (INTERNAL_SIZE_T *) (newmem);
- ncopies = copysize / sizeof (INTERNAL_SIZE_T);
- assert (ncopies >= 3);
-
- if (ncopies > 9)
- memcpy (d, s, copysize);
-
- else
- {
- *(d + 0) = *(s + 0);
- *(d + 1) = *(s + 1);
- *(d + 2) = *(s + 2);
- if (ncopies > 4)
- {
- *(d + 3) = *(s + 3);
- *(d + 4) = *(s + 4);
- if (ncopies > 6)
- {
- *(d + 5) = *(s + 5);
- *(d + 6) = *(s + 6);
- if (ncopies > 8)
- {
- *(d + 7) = *(s + 7);
- *(d + 8) = *(s + 8);
- }
- }
- }
- }
-
+ memcpy (newmem, chunk2mem (oldp), oldsize - SIZE_SZ);
_int_free (av, oldp, 1);
check_inuse_chunk (av, newp);
return chunk2mem (newp);
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 7 +++++++
NEWS | 1 +
malloc/malloc.c | 43 +------------------------------------------
3 files changed, 9 insertions(+), 42 deletions(-)
hooks/post-receive
--
GNU C Library master sources