[PATCH 0/4] Fixes for memory allocation bugs
Keith Packard
keithp@keithp.com
Tue Aug 11 23:05:39 GMT 2020
There are two serious bug fixes here:
1) Check calloc/reallocarray for overflow in the multiply using
__builtin_mul_overflow (which exists in gcc and clang). reallocarray
was using some old BSD code for this, but __builtin_mul_overflow is
both more efficient and more easily checked for correctness.
2) nano_realloc was copying too many bytes from the existing
allocation when increasing the allocation size. This could lead to
information disclosure, or a crash.
And a couple of minor improvements:
3) When nano_realloc is shrinking "a lot", re-allocate the
buffer to make the original memory available.
4) When nano_realloc is shrinking and the new allocation fails,
just return the old buffer to avoid having applications see
unnecessary failures.
More information about the Newlib
mailing list