|
 |
bdc76f |
commit ebe544bf6e8eec35e754fd49efb027c6f161b6cb
|
|
|
bdc76f |
Author: Istvan Kurucsai <pistukem@gmail.com>
|
|
|
bdc76f |
Date: Thu Dec 20 23:30:07 2018 -0500
|
|
|
bdc76f |
|
|
|
bdc76f |
malloc: Add more integrity checks to mremap_chunk.
|
|
|
bdc76f |
|
|
|
bdc76f |
* malloc/malloc.c (mremap_chunk): Additional checks.
|
|
|
bdc76f |
|
|
|
bdc76f |
diff --git a/malloc/malloc.c b/malloc/malloc.c
|
|
|
bdc76f |
index eb6a8ff33c0c313b..4df5cb4862a7b854 100644
|
|
|
bdc76f |
--- a/malloc/malloc.c
|
|
|
bdc76f |
+++ b/malloc/malloc.c
|
|
|
bdc76f |
@@ -2856,16 +2856,22 @@ mremap_chunk (mchunkptr p, size_t new_size)
|
|
|
bdc76f |
char *cp;
|
|
|
bdc76f |
|
|
|
bdc76f |
assert (chunk_is_mmapped (p));
|
|
|
bdc76f |
- assert (((size + offset) & (GLRO (dl_pagesize) - 1)) == 0);
|
|
|
bdc76f |
+
|
|
|
bdc76f |
+ uintptr_t block = (uintptr_t) p - offset;
|
|
|
bdc76f |
+ uintptr_t mem = (uintptr_t) chunk2mem(p);
|
|
|
bdc76f |
+ size_t total_size = offset + size;
|
|
|
bdc76f |
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
|
|
|
bdc76f |
+ || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
|
|
|
bdc76f |
+ malloc_printerr("mremap_chunk(): invalid pointer");
|
|
|
bdc76f |
|
|
|
bdc76f |
/* Note the extra SIZE_SZ overhead as in mmap_chunk(). */
|
|
|
bdc76f |
new_size = ALIGN_UP (new_size + offset + SIZE_SZ, pagesize);
|
|
|
bdc76f |
|
|
|
bdc76f |
/* No need to remap if the number of pages does not change. */
|
|
|
bdc76f |
- if (size + offset == new_size)
|
|
|
bdc76f |
+ if (total_size == new_size)
|
|
|
bdc76f |
return p;
|
|
|
bdc76f |
|
|
|
bdc76f |
- cp = (char *) __mremap ((char *) p - offset, size + offset, new_size,
|
|
|
bdc76f |
+ cp = (char *) __mremap ((char *) block, total_size, new_size,
|
|
|
bdc76f |
MREMAP_MAYMOVE);
|
|
|
bdc76f |
|
|
|
bdc76f |
if (cp == MAP_FAILED)
|