bugAVR C Runtime Library - Bugs: bug #32702, Realloc can reduce size of...

 
 

bug #32702: Realloc can reduce size of location less than (sizeof(struct __freelist) - sizeof(size_t))

Submitted by:  Vinnipuh <vinni>
Submitted on:  Mon 07 Mar 2011 11:10:22 PM UTC  
 
Category:  Library Severity:  3 - Normal
Priority:  9 - Immediate Item Group:  libc code
Status:  None Percent Complete:  0%
Assigned to:  Joerg Wunsch <joerg_wunsch> Open/Closed:  Open
Release:  1.7.* Fixed Release:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 10 Nov 2013 11:20:36 AM UTC, comment #3:

I am sorry for the noise.

The check is indeed in malloc(), but not in realloc().

So this one would be great to be added as well.

Maybe even the len == 0 check in my bug #40535 could be integrated here as well...

Thomas R. <glglgl>
Sun 10 Nov 2013 11:06:30 AM UTC, comment #2:

It seems this is already in the code and thus can be closed, can't it?

Thomas R. <glglgl>
Mon 26 Sep 2011 03:25:26 PM UTC, comment #1:

Joerg, this one is more in your area....

Eric Weddington <arcanum>
Project Administrator
Mon 07 Mar 2011 11:10:22 PM UTC, original submission:

Necessary check into the beginning realloc as in malloc:

/*
* Our minimum chunk size is the size of a pointer (plus the
* size of the "sz" field, but we don't need to account for
* this), otherwise we could not possibly fit a freelist entry
* into the chunk later.
*/
if (len < sizeof(struct __freelist) - sizeof(size_t))
len = sizeof(struct __freelist) - sizeof(size_t);

Test case:
{
struct __freelist *fp;
char p, p1;

p = malloc( sizeof(struct __freelist) + 1 ); /// 5
if (!p)
return 1;

/* really size must not decrease */
p1 = realloc( p, sizeof(struct __freelist) - sizeof(size_t) - 1 ); /// 1
if (p != p1)
return 2;

fp = (struct __freelist *)(p - sizeof(size_t));
if ( fp->sz != sizeof(struct __freelist) + 1 )
return 3;
}

Vinnipuh <vinni>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #22869:  bug32702.diff added by vinni (741B - application/octet-stream - patch for fix this bag)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by glglgl (Posted a comment)
  • -email is unavailable- added by arcanum (Posted a comment)
  • -email is unavailable- added by vinni (Submitted the item)
  •  

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-11-16 arcanum Priority5 - Normal => 9 - Immediate
    2011-09-26 arcanum Assigned toNone => joerg_wunsch
    2011-03-09 vinni Attached File- => Added bug32702.diff, #22869

    Back to the top


    Powered by Savane 3.3