[PATCH 3/4] dlmalloc: Fix integer overflow in sbrk()
Simon Glass
sjg at chromium.org
Tue Aug 6 23:50:41 CEST 2024
On Fri, 2 Aug 2024 at 04:08, Richard Weinberger <richard at nod.at> wrote:
>
> Make sure that the new break is within mem_malloc_start
> and mem_malloc_end before making progress.
> ulong new = old + increment; can overflow for extremely large
> increment values and memset() can get wrongly called.
>
> Signed-off-by: Richard Weinberger <richard at nod.at>
> ---
> common/dlmalloc.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
Reviewed-by: Simon Glass <sjg at chromium.org>
Should we update dlmalloc to the new version?
>
> diff --git a/common/dlmalloc.c b/common/dlmalloc.c
> index 44b06e38b2..c8d1da1cb1 100644
> --- a/common/dlmalloc.c
> +++ b/common/dlmalloc.c
> @@ -581,6 +581,9 @@ void *sbrk(ptrdiff_t increment)
> ulong old = mem_malloc_brk;
> ulong new = old + increment;
>
> + if ((new < mem_malloc_start) || (new > mem_malloc_end))
> + return (void *)MORECORE_FAILURE;
> +
> /*
> * if we are giving memory back make sure we clear it out since
> * we set MORECORE_CLEARS to 1
> @@ -588,9 +591,6 @@ void *sbrk(ptrdiff_t increment)
> if (increment < 0)
> memset((void *)new, 0, -increment);
>
> - if ((new < mem_malloc_start) || (new > mem_malloc_end))
> - return (void *)MORECORE_FAILURE;
> -
> mem_malloc_brk = new;
>
> return (void *)old;
> --
> 2.35.3
>
More information about the U-Boot
mailing list