[PATCH v2] memalign: Add alignment overflow check (CVE-2026-0861)

[Siddhesh Poyarekar]

On 2026-01-15 05:44, Siddhesh Poyarekar wrote:
> On 2026-01-15 04:15, Florian Weimer wrote:
>> * Siddhesh Poyarekar:
>>
>>> +  ptrdiff_t res __attribute_maybe_unused__;
>>> +  /* ALIGNMENT is a power of two, so adding MINSIZE won't overflow 
>>> it.  */
>>> +  if (__glibc_unlikely (__builtin_add_overflow (bytes,
>>> +                        alignment + MINSIZE,
>>> +                        &res)))
>>>       {
>>> +      __set_errno (ENOMEM);
>>> +      return NULL;
>>>       }
>>
>> The check is a bit iffy because _int_memalign does thos:
>>
>>    if (bytes > PTRDIFF_MAX)
>>      {
>>        __set_errno (ENOMEM);
>>        return NULL;
>>      }
>>    size_t nb = checked_request2size (bytes);
>>
>>    /* Call malloc with worst case padding to hit alignment.  */
>>    void *m = _int_malloc (av, nb + alignment + MINSIZE);
>>
>> And checked_request2size rounds up bytes above PTRDIFF_MAX.
>>
>> I would rather see a minimal fix in _int_memalign, to guard the actual
>> size computation against overflow.
> 
> I missed the fact that checked_request2size() could round bytes up. Then 
> we do need the two overflow checks, because there's a potential for 
> overflow in arena_get (ar_ptr, bytes + alignment + MINSIZE) in 
> _mid_memalign too.

Oh I should have clarified that I agree that the minimal _int_memalign 
check is sufficient to fix the CVE.  I don't fully understand the 
consequences of the arena_get overflow yet, but ISTM that in the worst 
case it should only return an unsuitable arena for allocation, which is 
moot since the allocation will later fail in _int_memalign.

Sid