diff options
| author | Richard Weinberger <richard@nod.at> | 2024-08-02 12:08:44 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2024-08-15 16:14:36 -0600 |
| commit | 8642b2178d2c4002c99a0b69a845a48f2ae2706f (patch) | |
| tree | b96d09d1a763e9e3d0bc9142def8d40be9d67349 /common/dlmalloc.c | |
| parent | c17b2a05dd50a3ba437e6373093a0d6a359cdee0 (diff) | |
dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.
Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'common/dlmalloc.c')
| -rw-r--r-- | common/dlmalloc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/common/dlmalloc.c b/common/dlmalloc.c index 1e1602a24de..48e83da6cbc 100644 --- a/common/dlmalloc.c +++ b/common/dlmalloc.c @@ -386,8 +386,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ /* pad request bytes into a usable size */ #define request2size(req) \ - (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ - (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ + ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ + (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK))) /* Check if m has acceptable alignment */ |