From: Ondřej Surý <ondrej@sury.org>
Date: Mon, 12 Jul 2021 06:43:14 +0000 (+0200)
Subject: Fix the real allocation size in OpenBSD rallocx shim
X-Git-Tag: v9.17.17~32^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d1a9e549b1a47352fca00bfb72b317bfbd4e8e13;p=thirdparty%2Fbind9.git

Fix the real allocation size in OpenBSD rallocx shim

In the rallocx() shim for OpenBSD (that's the only platform that doesn't
have malloc_size() or malloc_usable_size() equivalent), the newly
allocated size was missing the extra size_t member for storing the
allocation size leading to size_t sized overflow at the end of the
reallocated memory chunk.
---

diff --git a/lib/isc/jemalloc_shim.h b/lib/isc/jemalloc_shim.h
index 11f80996614..d04ac22ac3e 100644
--- a/lib/isc/jemalloc_shim.h
+++ b/lib/isc/jemalloc_shim.h
@@ -106,7 +106,7 @@ static inline void *
 rallocx(void *ptr, size_t size, int flags) {
 	UNUSED(flags);
 
-	size_t *__ptr = realloc(&((size_t *)ptr)[-1], size);
+	size_t *__ptr = realloc(&((size_t *)ptr)[-1], size + sizeof(size_t));
 	REQUIRE(__ptr != NULL);
 	__ptr[0] = size;