aboutsummaryrefslogtreecommitdiff
path: root/malloc
diff options
context:
space:
mode:
authorIstvan Kurucsai <pistukem@gmail.com>2018-12-20 23:30:07 -0500
committerDJ Delorie <dj@delorie.com>2018-12-20 23:31:37 -0500
commitebe544bf6e8eec35e754fd49efb027c6f161b6cb (patch)
tree6cab1e7bf56a69968d5ece9678dbb9676a830990 /malloc
parent5f72b00591ce4d1b4c0418294ffe1623983d5679 (diff)
downloadglibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.tar
glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.tar.gz
glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.tar.bz2
glibc-ebe544bf6e8eec35e754fd49efb027c6f161b6cb.zip
malloc: Add more integrity checks to mremap_chunk.
* malloc/malloc.c (mremap_chunk): Additional checks.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index c9b2c6e320..32d47f083c 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2928,16 +2928,22 @@ mremap_chunk (mchunkptr p, size_t new_size)
char *cp;
assert (chunk_is_mmapped (p));
- assert (((size + offset) & (GLRO (dl_pagesize) - 1)) == 0);
+
+ uintptr_t block = (uintptr_t) p - offset;
+ uintptr_t mem = (uintptr_t) chunk2mem(p);
+ size_t total_size = offset + size;
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+ || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
+ malloc_printerr("mremap_chunk(): invalid pointer");
/* Note the extra SIZE_SZ overhead as in mmap_chunk(). */
new_size = ALIGN_UP (new_size + offset + SIZE_SZ, pagesize);
/* No need to remap if the number of pages does not change. */
- if (size + offset == new_size)
+ if (total_size == new_size)
return p;
- cp = (char *) __mremap ((char *) p - offset, size + offset, new_size,
+ cp = (char *) __mremap ((char *) block, total_size, new_size,
MREMAP_MAYMOVE);
if (cp == MAP_FAILED)