dany/u-boot-megous
1
0
Fork 0
mirror of https://xff.cz/git/u-boot/ synced 2025-10-26 16:13:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

dlmalloc: Make sure allocation size is within malloc area

Browse Source 
Since U-Boot does not support memory overcommit we can
enforce that the allocation size is within the malloc area.
This is a simple and efficient hardening measure to mitigate
further integer overflows in dlmalloc.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Richard Weinberger
2024-08-02 12:08:46 +02:00
committed by Tom Rini
parent 0a10b49206
commit 9b9368b5c4
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
common/dlmalloc.c
View File

@@ -1274,7 +1274,8 @@ Void_t* mALLOc_impl(bytes) size_t bytes;
return NULL; return NULL;
} }
if ((long)bytes < 0) return NULL; if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
return NULL;
nb = request2size(bytes); /* padded request size; */ nb = request2size(bytes); /* padded request size; */
@@ -1687,7 +1688,8 @@ Void_t* rEALLOc_impl(oldmem, bytes) Void_t* oldmem; size_t bytes;
} }
#endif #endif
if ((long)bytes < 0) return NULL; if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
return NULL;
/* realloc of null is supposed to be same as malloc */ /* realloc of null is supposed to be same as malloc */
if (oldmem == NULL) return mALLOc_impl(bytes); if (oldmem == NULL) return mALLOc_impl(bytes);
@@ -1911,7 +1913,8 @@ Void_t* mEMALIGn_impl(alignment, bytes) size_t alignment; size_t bytes;
mchunkptr remainder; /* spare room at end to split off */ mchunkptr remainder; /* spare room at end to split off */
long remainder_size; /* its size */ long remainder_size; /* its size */
if ((long)bytes < 0) return NULL; if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
return NULL;
#if CONFIG_IS_ENABLED(SYS_MALLOC_F) #if CONFIG_IS_ENABLED(SYS_MALLOC_F)
if (!(gd->flags & GD_FLG_FULL_MALLOC_INIT)) { if (!(gd->flags & GD_FLG_FULL_MALLOC_INIT)) {