fluencelabs/musl
1
0
Fork 0
mirror of https://github.com/fluencelabs/musl synced 2025-04-24 23:02:14 +00:00
Code Issues Projects Releases Wiki Activity

malloc: fix an over-allocation bug

Browse Source 
Fix an instance where realloc code would overallocate by OVERHEAD bytes
amount. Manually arrange for reuse of memcpy-free-return exit sequence.
This commit is contained in:
Alexander Monakov 2018-04-16 20:54:35 +03:00 committed by Rich Felker
parent b9410061e2
commit d889cc3463
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/malloc/malloc.c
View File

@ -414,10 +414,9 @@ void *realloc(void *p, size_t n)
size_t newlen = n + extra; size_t newlen = n + extra;
/* Crash on realloc of freed chunk */ /* Crash on realloc of freed chunk */
if (extra & 1) a_crash(); if (extra & 1) a_crash();
if (newlen < PAGE_SIZE && (new = malloc(n))) { if (newlen < PAGE_SIZE && (new = malloc(n-OVERHEAD))) {
memcpy(new, p, n-OVERHEAD); n0 = n;
free(p); goto copy_free_ret;
return new;
} }
newlen = (newlen + PAGE_SIZE-1) & -PAGE_SIZE; newlen = (newlen + PAGE_SIZE-1) & -PAGE_SIZE;
if (oldlen == newlen) return p; if (oldlen == newlen) return p;
@ -460,6 +459,7 @@ copy_realloc:
/* As a last resort, allocate a new chunk and copy to it. */ /* As a last resort, allocate a new chunk and copy to it. */
new = malloc(n-OVERHEAD); new = malloc(n-OVERHEAD);
if (!new) return 0; if (!new) return 0;
copy_free_ret:
memcpy(new, p, n0-OVERHEAD); memcpy(new, p, n0-OVERHEAD);
free(CHUNK_TO_MEM(self)); free(CHUNK_TO_MEM(self));
return new; return new;