bugAVR C Runtime Library - Bugs: bug #32702, Realloc can reduce size of...


bug #32702: Realloc can reduce size of location less than (sizeof(struct __freelist) - sizeof(size_t))

Submitted by:  Vinnipuh <vinni>
Submitted on:  Mon 07 Mar 2011 11:10:22 PM UTC  
Category: LibrarySeverity: 3 - Normal
Priority: 9 - ImmediateItem Group: libc code
Status: NonePercent Complete: 0%
Assigned to: Joerg Wunsch <joerg_wunsch>Open/Closed: Open
Release: 1.7.*Fixed Release: None

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 10 Nov 2013 11:20:36 AM UTC, comment #3:

I am sorry for the noise.

The check is indeed in malloc(), but not in realloc().

So this one would be great to be added as well.

Maybe even the len == 0 check in my bug #40535 could be integrated here as well...

Thomas R. <glglgl>
Sun 10 Nov 2013 11:06:30 AM UTC, comment #2:

It seems this is already in the code and thus can be closed, can't it?

Thomas R. <glglgl>
Mon 26 Sep 2011 03:25:26 PM UTC, comment #1:

Joerg, this one is more in your area....

Eric Weddington <arcanum>
Project Administrator
Mon 07 Mar 2011 11:10:22 PM UTC, original submission:

Necessary check into the beginning realloc as in malloc:

* Our minimum chunk size is the size of a pointer (plus the
* size of the "sz" field, but we don't need to account for
* this), otherwise we could not possibly fit a freelist entry
* into the chunk later.
if (len < sizeof(struct __freelist) - sizeof(size_t))
len = sizeof(struct __freelist) - sizeof(size_t);

Test case:
struct __freelist *fp;
char p, p1;

p = malloc( sizeof(struct __freelist) + 1 ); /// 5
if (!p)
return 1;

/* really size must not decrease */
p1 = realloc( p, sizeof(struct __freelist) - sizeof(size_t) - 1 ); /// 1
if (p != p1)
return 2;

fp = (struct __freelist *)(p - sizeof(size_t));
if ( fp->sz != sizeof(struct __freelist) + 1 )
return 3;

Vinnipuh <vinni>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #22869:  bug32702.diff added by vinni (741B - application/octet-stream - patch for fix this bag)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by glglgl (Posted a comment)
  • -unavailable- added by arcanum (Posted a comment)
  • -unavailable- added by vinni (Submitted the item)

    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 16 Nov 2012 06:57:22 PM UTCarcanumPriority5 - Normal=>9 - Immediate
    Mon 26 Sep 2011 03:25:26 PM UTCarcanumAssigned toNone=>joerg_wunsch
    Wed 09 Mar 2011 06:41:57 PM UTCvinniAttached File-=>Added bug32702.diff, #22869

    Back to the top

    Powered by Savane 3.1-cleanup1