Null-pointer dereference bug in nano-malloc

[Corinna Vinschen]

On Jan 24 22:04, Cyril Yared wrote:
> Hi,
> It appears that commit 84d068971 introduced a null-pointer dereference in
> nano-malloc when the following two conditions are met:
> 
> 1). The free_list has no items (= NULL).
> 2). The call to sbrk_aligned returns -1 (failure).
> 
> On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:
> 
> if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
> {
> 
> If the two conditions are met, then p = free_list = NULL so p->size will be
> a null-pointer dereference. Is this something that's known/being tracked
> anywhere?

I don't think so.  Just send a patch, please.


Corinna