diff mbox

[RFC,1/7] malloc: Add check for top size corruption.

Message ID 1496220235-12750-2-git-send-email-pistukem@gmail.com
State New, archived
Headers

Commit Message

Istvan Kurucsai May 31, 2017, 8:43 a.m. UTC 
  Ensure that the size of top is below av->system_mem.

    * malloc/malloc.c (_int_malloc): Check top size.
---
 malloc/malloc.c | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox

Patch

diff --git a/malloc/malloc.c b/malloc/malloc.c
index aa45626..458b57d 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3801,6 +3801,13 @@  _int_malloc (mstate av, size_t bytes)
 
       if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
         {
+          if (__glibc_unlikely ((unsigned long) (size) > 
+                                (unsigned long) (av->system_mem)))
+            {
+              errstr = "malloc(): corrupted top chunk";
+              goto errout;
+            }
+
           remainder_size = size - nb;
           remainder = chunk_at_offset (victim, nb);
           av->top = remainder;