src/patches/glibc/glibc-rh1008310.patch

   1 diff -Nrup a/malloc/malloc.c b/malloc/malloc.c
   2 --- a/malloc/malloc.c   2013-09-23 17:08:33.698331221 -0400
   3 +++ b/malloc/malloc.c   2013-09-23 21:04:25.901270645 -0400
   4 @@ -3879,6 +3879,13 @@ public_mEMALIGn(size_t alignment, size_t
   5    /* Otherwise, ensure that it is at least a minimum chunk size */
   6    if (alignment <  MINSIZE) alignment = MINSIZE;
   7
   8 +  /* Check for overflow.  */
   9 +  if (bytes > SIZE_MAX - alignment - MINSIZE)
  10 +    {
  11 +      __set_errno (ENOMEM);
  12 +      return 0;
  13 +    }
  14 +
  15    arena_get(ar_ptr, bytes + alignment + MINSIZE);
  16    if(!ar_ptr)
  17      return 0;
  18 @@ -3924,6 +3931,13 @@ public_vALLOc(size_t bytes)
  19
  20    size_t pagesz = mp_.pagesize;
  21
  22 +  /* Check for overflow.  */
  23 +  if (bytes > SIZE_MAX - pagesz - MINSIZE)
  24 +    {
  25 +      __set_errno (ENOMEM);
  26 +      return 0;
  27 +    }
  28 +
  29    __malloc_ptr_t (*hook) __MALLOC_PMT ((size_t, size_t,
  30                                         __const __malloc_ptr_t)) =
  31      force_reg (__memalign_hook);
  32 @@ -3975,6 +3989,13 @@ public_pVALLOc(size_t bytes)
  33    size_t page_mask = mp_.pagesize - 1;
  34    size_t rounded_bytes = (bytes + page_mask) & ~(page_mask);
  35
  36 +  /* Check for overflow.  */
  37 +  if (bytes > SIZE_MAX - 2*pagesz - MINSIZE)
  38 +    {
  39 +      __set_errno (ENOMEM);
  40 +      return 0;
  41 +    }
  42 +
  43    __malloc_ptr_t (*hook) __MALLOC_PMT ((size_t, size_t,
  44                                         __const __malloc_ptr_t)) =
  45      force_reg (__memalign_hook);