[Bug malloc/33796] Integer overflow in _int_memalign leads to heap corruption (CVE-2026-0861)

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=33796

--- Comment #10 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.35/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=499d1ccafccfe64df1b88deea2fa84d8180e8e8f

commit 499d1ccafccfe64df1b88deea2fa84d8180e8e8f
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Thu Jan 15 06:06:40 2026 -0500

    memalign: reinstate alignment overflow check (CVE-2026-0861)

    The change to cap valid sizes to PTRDIFF_MAX inadvertently dropped the
    overflow check for alignment in memalign functions, _mid_memalign and
    _int_memalign.  Reinstate the overflow check in _int_memalign, aligned
    with the PTRDIFF_MAX change since that is directly responsible for the
    CVE.  The missing _mid_memalign check is not relevant (and does not have
    a security impact) and may need a different approach to fully resolve,
    so it has been omitted.

    CVE-Id: CVE-2026-0861
    Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206
    Reported-by: Igor Morgenstern, Aisle Research
    Fixes: BZ #33796
    Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com>
    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
    (cherry picked from commit c9188d333717d3ceb7e3020011651f424f749f93)

-- 
You are receiving this mail because:
You are on the CC list for the bug.