glibc/malloc
Arjun Shankar 8e448310d7 Fix integer overflows in internal memalign and malloc functions [BZ #22343]
When posix_memalign is called with an alignment less than MALLOC_ALIGNMENT
and a requested size close to SIZE_MAX, it falls back to malloc code
(because the alignment of a block returned by malloc is sufficient to
satisfy the call).  In this case, an integer overflow in _int_malloc leads
to posix_memalign incorrectly returning successfully.

Upon fixing this and writing a somewhat thorough regression test, it was
discovered that when posix_memalign is called with an alignment larger than
MALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size
close to SIZE_MAX, a different integer overflow in _int_memalign leads to
posix_memalign incorrectly returning successfully.

Both integer overflows affect other memory allocation functions that use
_int_malloc (one affected malloc in x86) or _int_memalign as well.

This commit fixes both integer overflows.  In addition to this, it adds a
regression test to guard against false successful allocations by the
following memory allocation functions when called with too-large allocation
sizes and, where relevant, various valid alignments:
malloc, realloc, calloc, reallocarray, memalign, posix_memalign,
aligned_alloc, valloc, and pvalloc.
2018-01-18 17:55:45 +01:00
..
Depend
Makefile Fix integer overflows in internal memalign and malloc functions [BZ #22343] 2018-01-18 17:55:45 +01:00
Versions
alloc_buffer_alloc_array.c
alloc_buffer_allocate.c
alloc_buffer_copy_bytes.c
alloc_buffer_copy_string.c
alloc_buffer_create_failure.c
arena.c
dynarray-skeleton.c
dynarray.h
dynarray_at_failure.c
dynarray_emplace_enlarge.c
dynarray_finalize.c
dynarray_resize.c
dynarray_resize_clear.c
hooks.c
malloc-hooks.h
malloc-internal.h
malloc.c Fix integer overflows in internal memalign and malloc functions [BZ #22343] 2018-01-18 17:55:45 +01:00
malloc.h
mallocbug.c
mcheck-init.c
mcheck.c
mcheck.h
memusage.c
memusage.sh
memusagestat.c
morecore.c
mtrace.c
mtrace.pl
obstack.c
obstack.h
reallocarray.c
scratch_buffer_grow.c
scratch_buffer_grow_preserve.c
scratch_buffer_set_array_size.c
set-freeres.c
thread-freeres.c
tst-alloc_buffer.c
tst-calloc.c
tst-dynarray-at-fail.c
tst-dynarray-fail.c
tst-dynarray-shared.h
tst-dynarray.c
tst-interpose-aux-nothread.c
tst-interpose-aux-thread.c
tst-interpose-aux.c
tst-interpose-aux.h
tst-interpose-nothread.c
tst-interpose-skeleton.c
tst-interpose-static-nothread.c
tst-interpose-static-thread.c
tst-interpose-thread.c
tst-malloc-backtrace.c
tst-malloc-fork-deadlock.c
tst-malloc-tcache-leak.c Increase some test timeouts. 2018-01-04 21:58:40 +00:00
tst-malloc-thread-exit.c
tst-malloc-thread-fail.c
tst-malloc-too-large.c Fix integer overflows in internal memalign and malloc functions [BZ #22343] 2018-01-18 17:55:45 +01:00
tst-malloc-usable-static-tunables.c
tst-malloc-usable-static.c
tst-malloc-usable-tunables.c
tst-malloc-usable.c
tst-malloc.c
tst-malloc_info.c
tst-mallocfork.c
tst-mallocfork2.c
tst-mallocstate.c
tst-mallopt.c
tst-mcheck.c
tst-memalign.c
tst-mtrace.c
tst-mtrace.sh
tst-obstack.c
tst-posix_memalign.c
tst-pvalloc.c
tst-realloc.c
tst-reallocarray.c
tst-scratch_buffer.c
tst-trim1.c
tst-valloc.c