bugAVR C Runtime Library - Bugs: bug #32702, Realloc can reduce size of...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #32702: Realloc can reduce size of location less than (sizeof(struct __freelist) - sizeof(size_t))

Submitter:  Vinnipuh <vinni>
Submitted:  Mon 07 Mar 2011 11:10:22 PM UTC
   
 
Category:  Library Severity:  3 - Normal
Priority:  9 - Immediate Item Group:  libc code
Status:  None Assigned to:  joerg_wunsch
Percent Complete:  0% Open/Closed:  Open
Release:  1.7.* Fixed Release:  None

Sun 10 Nov 2013 11:20:36 AM UTC, comment #3: 

I am sorry for the noise.

The check is indeed in malloc(), but not in realloc().

So this one would be great to be added as well.

Maybe even the len == 0 check in my bug #40535 could be integrated here as well...

Thomas R. <glglgl>
Sun 10 Nov 2013 11:06:30 AM UTC, comment #2: 

It seems this is already in the code and thus can be closed, can't it?

Thomas R. <glglgl>
Mon 26 Sep 2011 03:25:26 PM UTC, comment #1: 

Joerg, this one is more in your area....

Eric Weddington <arcanum>
Group administrator
Mon 07 Mar 2011 11:10:22 PM UTC, original submission:  


Necessary check into the beginning realloc as in malloc:

/*
* Our minimum chunk size is the size of a pointer (plus the
* size of the "sz" field, but we don't need to account for
* this), otherwise we could not possibly fit a freelist entry
* into the chunk later.
*/
if (len < sizeof(struct __freelist) - sizeof(size_t))
len = sizeof(struct __freelist) - sizeof(size_t);

Test case:
{
struct __freelist *fp;
char *p, *p1;

p = malloc( sizeof(struct __freelist) + 1 ); /// 5
if (!p)
return 1;

/* really size must not decrease */
p1 = realloc( p,  sizeof(struct __freelist) - sizeof(size_t) - 1 ); /// 1
if (p != p1)
return 2;

fp = (struct __freelist *)(p - sizeof(size_t));
if ( fp->sz != sizeof(struct __freelist) + 1 )
return 3;
}

Vinnipuh <vinni>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #22869:  bug32702.diff added by vinni (741B - application/octet-stream - patch for fix this bag)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by glglgl (Posted a comment)
  • -email is unavailable- added by arcanum (Posted a comment)
  • -email is unavailable- added by vinni (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-11-16 arcanum Priority5 - Normal 9 - Immediate
    2011-09-26 arcanum Assigned toNone joerg_wunsch
    2011-03-09 vinni Attached File- Added bug32702.diff, #22869

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code