From 659e70628ec5090df32224eac99b5d635179d142 Mon Sep 17 00:00:00 2001 From: Jeff Johnston Date: Fri, 9 Aug 2002 21:33:29 +0000 Subject: 2002-08-09 Jason Tishler * libc/stdlib/mallocr.c: Include . (request2size): Change macro to do unsigned long comparisons and avoid signed overflow. (mALLOc): Add overflow check for the number of bytes to allocate. (rEALLOc): Ditto. --- newlib/libc/stdlib/mallocr.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'newlib/libc/stdlib/mallocr.c') diff --git a/newlib/libc/stdlib/mallocr.c b/newlib/libc/stdlib/mallocr.c index 91370056e..89838f656 100644 --- a/newlib/libc/stdlib/mallocr.c +++ b/newlib/libc/stdlib/mallocr.c @@ -271,6 +271,7 @@ extern "C" { #endif #include /* needed for malloc_stats */ +#include /* needed for overflow checks */ /* @@ -1399,8 +1400,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ /* pad request bytes into a usable size */ #define request2size(req) \ - (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ - (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? ((MINSIZE + MALLOC_ALIGN_MASK) & ~(MALLOC_ALIGN_MASK)) : \ + (((unsigned long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ + (unsigned long)(MINSIZE + MALLOC_ALIGN_MASK)) ? ((MINSIZE + MALLOC_ALIGN_MASK) & ~(MALLOC_ALIGN_MASK)) : \ (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK))) /* Check if m has acceptable alignment */ @@ -2333,6 +2334,10 @@ Void_t* mALLOc(RARG bytes) RDECL size_t bytes; INTERNAL_SIZE_T nb = request2size(bytes); /* padded request size; */ + /* Check for overflow and just fail, if so. */ + if (nb > INT_MAX) + return 0; + MALLOC_LOCK; /* Check for exact match in a bin */ @@ -2792,6 +2797,10 @@ Void_t* rEALLOc(RARG oldmem, bytes) RDECL Void_t* oldmem; size_t bytes; nb = request2size(bytes); + /* Check for overflow and just fail, if so. */ + if (nb > INT_MAX) + return 0; + #if HAVE_MMAP if (chunk_is_mmapped(oldp)) { -- cgit v1.2.3