AVR C Runtime Library - Bugs: bug #53284, realloc() does not respect...
You are not allowed to post comments on this tracker with your current authentication level.
bug #53284: realloc() does not respect __freelist size for small allocations
Submitter: | David Glaze <djglaze> | ||
Submitted: | Sun 04 Mar 2018 10:19:44 PM UTC | ||
Category: | Library | Severity: | 3 - Normal |
Priority: | 5 - Normal | Item Group: | libc code |
Status: | None | Percent Complete: | 0% |
Assigned to: | None | Open/Closed: | Open |
Release: | 2.0.0 | Fixed Release: | None |
Fri 17 Jan 2020 05:58:01 AM UTC, comment #2: |
Petteri Aimonen <jpa_fi> |
Tue 31 Dec 2019 10:41:55 AM UTC, comment #1: This got triggered by nanopb fuzz tests; I'm adding a workaround on my library side as this would otherwise have potential security implications. It would be great if this could eventually be fixed on avr-libc side.
|
Petteri Aimonen <jpa_fi> |
Sun 04 Mar 2018 10:19:44 PM UTC, original submission:
The realloc() function does not respect the __freelist size when resizing an allocation down to 0 or 1 bytes. If this allocation is then deallocated with free(), a __freelist entry is placed in its slot that can partially overwrite an adjacent allocation, leading to irrecoverable memory corruption. The following code can reproduce the corruption:
|
David Glaze <djglaze> |
Depends on the following items: None found
Items that depend on this one: None found
Related other bugs: #40535, #32702