[Bug malloc/24027] glibc: realloc() ncopies 32-bit integer overflow

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=24027

--- Comment #5 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.24/master has been updated
       via  22b7478755c07f4741db85d14fc2b57837078ca6 (commit)
      from  fcd316654a4510281fff32194b3b9f90e3dfab83 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=22b7478755c07f4741db85d14fc2b57837078ca6

commit 22b7478755c07f4741db85d14fc2b57837078ca6
Author: Florian Weimer <fw@deneb.enyo.de>
Date:   Mon Dec 31 22:04:36 2018 +0100

    malloc: Always call memcpy in _int_realloc [BZ #24027]

    This commit removes the custom memcpy implementation from _int_realloc
    for small chunk sizes.  The ncopies variable has the wrong type, and
    an integer wraparound could cause the existing code to copy too few
    elements (leaving the new memory region mostly uninitialized).
    Therefore, removing this code fixes bug 24027.

    (cherry picked from commit b50dd3bc8cbb1efe85399b03d7e6c0310c2ead84)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    7 +++++++
 NEWS            |    1 +
 malloc/malloc.c |   43 +------------------------------------------
 3 files changed, 9 insertions(+), 42 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.