Fix 393099 - posix_memalign() invalid write if alignment == 0

Bug and analysis by Gabriel Ganne

diff --git a/coregrind/m_replacemalloc/vg_replace_malloc.c b/coregrind/m_replacemalloc/vg_replace_malloc.c
index 9fb0069b171a2e315ba76617de92b00cc4893078..11f6a90ba04321f7d83309e80b448d52b23f4963 100644 (file)
--- a/coregrind/m_replacemalloc/vg_replace_malloc.c
+++ b/coregrind/m_replacemalloc/vg_replace_malloc.c
@@ -1001,7 +1001,8 @@ static void init(void);
       \
       /* Test whether the alignment argument is valid.  It must be \
          a power of two multiple of sizeof (void *).  */ \
-      if (alignment % sizeof (void *) != 0 \
+      if (alignment == 0 \
+          || alignment % sizeof (void *) != 0 \
           || (alignment & (alignment - 1)) != 0) \
          return VKI_EINVAL; \
       \

diff --git a/memcheck/tests/memalign2.c b/memcheck/tests/memalign2.c
index 39069a6fb8578c86f0d15670fdb0b9d5bce54e27..95d13354e71691754f2a5ce003e5a9c80c0ff07f 100644 (file)
--- a/memcheck/tests/memalign2.c
+++ b/memcheck/tests/memalign2.c
@@ -82,7 +82,7 @@ int main ( void )
 #  define PM(a,b,c) posix_memalign((void**)a, b, c)
 
    res = PM(&p, -1,100);      assert(EINVAL == res);
-   res = PM(&p, 0, 100);      assert(0 == res && 0 == (long)p % 8);
+   res = PM(&p, 0, 100);      assert(EINVAL == res);
    res = PM(&p, 1, 100);      assert(EINVAL == res);
    res = PM(&p, 2, 100);      assert(EINVAL == res);
    res = PM(&p, 3, 100);      assert(EINVAL == res);