[PATCH] Fix integer overflow in malloc when tcache is enabled [BZ #22375]

[Siddhesh Poyarekar]

On Monday 06 November 2017 10:02 PM, Arjun Shankar wrote:
> When the per-thread cache is enabled, __libc_malloc uses request2size (which
> does not perform an overflow check) to calculate the chunk size from the
> requested allocation size. This leads to an integer overflow causing malloc
> to incorrectly return the last successfully allocated block when called with
> a very large size argument (close to SIZE_MAX) instead of returning NULL and
> setting errno to ENOMEM.

That sounds CVE-worthy.

Siddhesh