[PATCH v2 2/2] malloc: Fix a potential realloc issue with memory tagging

[DJ Delorie]

Szabolcs Nagy via Libc-alpha <libc-alpha@sourceware.org> writes:
> At an _int_free call site in realloc the wrong size was used for tag
> clearing: the chunk header of the next chunk was also cleared which
> in practice may work, but logically wrong.
>
> The tag clearing is moved before the memcpy to save a tag computation,
> this avoids a chunk2mem.  Another chunk2mem is removed because newmem
> does not have to be recomputed. Whitespaces got fixed too.

LGTM.
Reviewed-by: DJ Delorie <dj@redhat.com>

(1/2 was already OK by me previously, and is unchanged)

> -	      void *oldmem = chunk2mem (oldp);
> +	      void *oldmem = chunk2rawmem (oldp);

Same but don't change the tag.  Ok.

> +	      size_t sz = CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ;

This should be "chunk plus next header, minus next header and ours.".
I.e. user mem size.  Ok.

> 	      newmem = TAG_NEW_USABLE (newmem);
> -	      memcpy (newmem, oldmem,
> -		      CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ);
> -	      (void) TAG_REGION (chunk2rawmem (oldp), oldsize);

> +	      (void) TAG_REGION (oldmem, sz);
> +	      memcpy (newmem, oldmem, sz);

In both cases we're copying from oldmem, which ends up chunk-tagged
instead of user-tagged, into newmem, which is already self-tagged.  No
overlap is possible.  Ok.

> -              _int_free (av, oldp, 1);
> -              check_inuse_chunk (av, newp);
> -              return chunk2mem (newp);
> +	      _int_free (av, oldp, 1);
> +	      check_inuse_chunk (av, newp);
> +	      return newmem;

whitespace OK.