diff options
| author | Richard Weinberger <[email protected]> | 2024-08-02 12:08:44 +0200 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2024-08-15 16:14:36 -0600 |
| commit | 8642b2178d2c4002c99a0b69a845a48f2ae2706f (patch) | |
| tree | b96d09d1a763e9e3d0bc9142def8d40be9d67349 /scripts/kernel-doc | |
| parent | c17b2a05dd50a3ba437e6373093a0d6a359cdee0 (diff) | |
dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.
Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.
Signed-off-by: Richard Weinberger <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Diffstat (limited to 'scripts/kernel-doc')
0 files changed, 0 insertions, 0 deletions
