Fix integer overflow in malloc when tcache is enabled [BZ #22375]

When the per-thread cache is enabled, __libc_malloc uses request2size (which
does not perform an overflow check) to calculate the chunk size from the
requested allocation size. This leads to an integer overflow causing malloc
to incorrectly return the last successfully allocated block when called with
a very large size argument (close to SIZE_MAX).

This commit uses checked_request2size instead, removing the overflow.

diff --git a/ChangeLog b/ChangeLog
index b55ed22f32484cad47c038a45a8480287f9e8412..888f9fbd671211d836003780dd41a7e8733eb0c3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-11-30  Arjun Shankar  <arjun@redhat.com>
+
+       [BZ #22375]
+       * malloc/malloc.c (__libc_malloc): Use checked_request2size
+       instead of request2size.
+
 2017-11-30  Joseph Myers  <joseph@codesourcery.com>
 
        * sysdeps/sparc/sparc32/sparcv9/fpu/multiarch/s_llrint.S

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 79f0e9eac7483b3fba19849a44029b5e8ba3bd33..0c9e0748b4c10988f6fe99ac2e5b21b8b7b603c3 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3031,7 +3031,8 @@ __libc_malloc (size_t bytes)
     return (*hook)(bytes, RETURN_ADDRESS (0));
 #if USE_TCACHE
   /* int_free also calls request2size, be careful to not pad twice.  */
-  size_t tbytes = request2size (bytes);
+  size_t tbytes;
+  checked_request2size (bytes, tbytes);
   size_t tc_idx = csize2tidx (tbytes);
 
   MAYBE_INIT_TCACHE ();