diff options
| author | Arjun Shankar <arjun@redhat.com> | 2017-11-30 13:31:45 +0100 |
|---|---|---|
| committer | Arjun Shankar <arjun@redhat.com> | 2017-11-30 13:42:53 +0100 |
| commit | 34697694e8a93b325b18f25f7dcded55d6baeaf6 (patch) | |
| tree | 694ad7ce28c06d16baff488f97f09e46d373564a /setjmp/longjmp.c | |
| parent | 18305fba5575a09063652014cfc483b898d8bdcd (diff) | |
| download | glibc-34697694e8a93b325b18f25f7dcded55d6baeaf6.tar glibc-34697694e8a93b325b18f25f7dcded55d6baeaf6.tar.gz glibc-34697694e8a93b325b18f25f7dcded55d6baeaf6.tar.bz2 glibc-34697694e8a93b325b18f25f7dcded55d6baeaf6.zip | |
Fix integer overflow in malloc when tcache is enabled [BZ #22375]
When the per-thread cache is enabled, __libc_malloc uses request2size (which
does not perform an overflow check) to calculate the chunk size from the
requested allocation size. This leads to an integer overflow causing malloc
to incorrectly return the last successfully allocated block when called with
a very large size argument (close to SIZE_MAX).
This commit uses checked_request2size instead, removing the overflow.
Diffstat (limited to 'setjmp/longjmp.c')
0 files changed, 0 insertions, 0 deletions