From: Istvan Kurucsai <pistukem@gmail.com>
Date: Fri, 21 Dec 2018 04:30:07 +0000 (-0500)
Subject: malloc: Add more integrity checks to mremap_chunk.
X-Git-Tag: glibc-2.29~109
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ebe544bf6e8eec35e754fd49efb027c6f161b6cb;p=thirdparty%2Fglibc.git

malloc: Add more integrity checks to mremap_chunk.

* malloc/malloc.c (mremap_chunk): Additional checks.
---

diff --git a/ChangeLog b/ChangeLog
index e7d231adcbc..ff9349f4e33 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-12-20  Istvan Kurucsai <pistukem@gmail.com>
+
+	* malloc/malloc.c (mremap_chunk): Additional checks.
+
 2018-12-21  Mao Han  <han_mao@c-sky.com>
 
 	* config.h.in (CSKYABI, CSKY_HARD_FLOAT): New Define.
diff --git a/malloc/malloc.c b/malloc/malloc.c
index c9b2c6e320e..32d47f083c3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2928,16 +2928,22 @@ mremap_chunk (mchunkptr p, size_t new_size)
   char *cp;
 
   assert (chunk_is_mmapped (p));
-  assert (((size + offset) & (GLRO (dl_pagesize) - 1)) == 0);
+
+  uintptr_t block = (uintptr_t) p - offset;
+  uintptr_t mem = (uintptr_t) chunk2mem(p);
+  size_t total_size = offset + size;
+  if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+      || __glibc_unlikely (!powerof2 (mem & (pagesize - 1))))
+    malloc_printerr("mremap_chunk(): invalid pointer");
 
   /* Note the extra SIZE_SZ overhead as in mmap_chunk(). */
   new_size = ALIGN_UP (new_size + offset + SIZE_SZ, pagesize);
 
   /* No need to remap if the number of pages does not change.  */
-  if (size + offset == new_size)
+  if (total_size == new_size)
     return p;
 
-  cp = (char *) __mremap ((char *) p - offset, size + offset, new_size,
+  cp = (char *) __mremap ((char *) block, total_size, new_size,
                           MREMAP_MAYMOVE);
 
   if (cp == MAP_FAILED)