From: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date: Tue, 9 Sep 2025 21:03:26 +0000 (+0200)
Subject: malloc: check "negative" tcache_key values by hand
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=245ea60b0e0f7d7abcc8ab3b693439df5f93fed9;p=thirdparty%2Fglibc.git

malloc: check "negative" tcache_key values by hand

instead of undefined cases from casting uintptr_t into intptr_t.
---

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 444dc61825..18ef6b5cb8 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3150,7 +3150,8 @@ tcache_key_initialize (void)
   int minimum_bits = __WORDSIZE / 4;
   int maximum_bits = __WORDSIZE - minimum_bits;
 
-  while (labs ((intptr_t) tcache_key) <= 0x1000000
+  while (tcache_key <= 0x1000000
+      || tcache_key >= ((uintptr_t) ULONG_MAX) - 0x1000000
       || stdc_count_ones (tcache_key) < minimum_bits
       || stdc_count_ones (tcache_key) > maximum_bits)
     {