From: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date: Wed, 23 Dec 2020 02:11:17 +0000 (+0530)
Subject: MTE: Do not pad size in realloc_check
X-Git-Tag: glibc-2.33~135
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=84c202246b74c2f75b36985ceff506b7a152c2fb;p=thirdparty%2Fglibc.git

MTE: Do not pad size in realloc_check

The MTE patch to add malloc support incorrectly padded the size passed
to _int_realloc by SIZE_SZ when it ought to have sent just the
chunksize.  Revert that bit of the change so that realloc works
correctly with MALLOC_CHECK_ set.

This also brings the realloc_check implementation back in sync with
libc_realloc.
---

diff --git a/malloc/hooks.c b/malloc/hooks.c
index 8a1c16dfa41..6474ba8b38e 100644
--- a/malloc/hooks.c
+++ b/malloc/hooks.c
@@ -315,7 +315,7 @@ realloc_check (void *oldmem, size_t bytes, const void *caller)
   __libc_lock_unlock (main_arena.mutex);
   if (!oldp)
     malloc_printerr ("realloc(): invalid pointer");
-  const INTERNAL_SIZE_T oldchsize = CHUNK_AVAILABLE_SIZE (oldp);
+  const INTERNAL_SIZE_T oldsize = chunksize (oldp);
 
   if (!checked_request2size (rb, &chnb))
     goto invert;
@@ -331,7 +331,8 @@ realloc_check (void *oldmem, size_t bytes, const void *caller)
       else
 #endif
       {
-        if (oldchsize >= chnb)
+	/* Note the extra SIZE_SZ overhead. */
+        if (oldsize - SIZE_SZ >= chnb)
           newmem = oldmem; /* do nothing */
         else
           {
@@ -340,7 +341,7 @@ realloc_check (void *oldmem, size_t bytes, const void *caller)
 	    newmem = _int_malloc (&main_arena, rb);
             if (newmem)
               {
-                memcpy (newmem, oldmem, oldchsize - CHUNK_HDR_SZ);
+                memcpy (newmem, oldmem, oldsize - CHUNK_HDR_SZ);
                 munmap_chunk (oldp);
               }
           }
@@ -349,7 +350,7 @@ realloc_check (void *oldmem, size_t bytes, const void *caller)
   else
     {
       top_check ();
-      newmem = _int_realloc (&main_arena, oldp, oldchsize, chnb);
+      newmem = _int_realloc (&main_arena, oldp, oldsize, chnb);
     }
 
   DIAG_PUSH_NEEDS_COMMENT;