diff options
| author | Richard Weinberger <[email protected]> | 2024-08-02 12:08:44 +0200 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2024-08-15 16:14:36 -0600 |
| commit | 8642b2178d2c4002c99a0b69a845a48f2ae2706f (patch) | |
| tree | b96d09d1a763e9e3d0bc9142def8d40be9d67349 | |
| parent | c17b2a05dd50a3ba437e6373093a0d6a359cdee0 (diff) | |
dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.
Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.
Signed-off-by: Richard Weinberger <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
| -rw-r--r-- | common/dlmalloc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/common/dlmalloc.c b/common/dlmalloc.c index 1e1602a24de..48e83da6cbc 100644 --- a/common/dlmalloc.c +++ b/common/dlmalloc.c @@ -386,8 +386,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ /* pad request bytes into a usable size */ #define request2size(req) \ - (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ - (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ + ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ + (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK))) /* Check if m has acceptable alignment */ |