Re: [PATCH] malloc: Always call memcpy in _int_realloc [BZ #24027]

[Siddhesh Poyarekar <siddhesh at gotplt dot org>]

On 26/12/18 1:59 AM, Florian Weimer wrote:
> This patch removes the custom memcpy implementation from _int_realloc
> for small chunk sizes.  ncopies has the wrong type and could thus
> result in too few elements being copied, so removing this code fixes
> bug 24027.  I don't think the inlining is performance-critical because
> this code is used when the realloc results in an _int_malloc, copy,
> and _int_free, so even for small allocations there is quote some
> overhead beyond the copy itself.
>
> I'm not sure if this warrants tracking as a security bug.  Looking at
> the code, the problem could be trigger in a default configuration if
> mremap fails and a subsequent mmap succeeds.
>
> 2018-12-23  Florian Weimer  <fw@deneb.enyo.de>
>
> 	[BZ #24027]
> 	* malloc/malloc.c (_int_realloc): Always call memcpy for the
> 	copying operation.

Fix looks OK to me.  Please add an explicit note in the description 
about the integer overflow so that if anybody tries to revert this patch 
in future they know that there's more to fix in there.

Siddhesh