From 45a6686e76bfcd48f7c72a23d0e15186f76b4bfc Mon Sep 17 00:00:00 2001 From: Jonathan Wakely Date: Tue, 12 May 2020 09:54:44 +0100 Subject: [PATCH] libstdc++: Fix incorrect size calculation in PMR resource (PR 94906) Calculating the size of a chunk being returned to the upstream allocator was done with a 32-bit type, so it wrapped if the chunk was 4GB or larger. I don't know how to test this without allocating 4GB, so there's no test in the testsuite. It has been tested manually of course. Backport from mainline 2020-05-04 Jonathan Wakely PR libstdc++/94906 * src/c++17/memory_resource.cc (monotonic_buffer_resource::_Chunk::release): Use size_t for shift operands. --- libstdc++-v3/ChangeLog | 10 ++++++++++ libstdc++-v3/src/c++17/memory_resource.cc | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/libstdc++-v3/ChangeLog b/libstdc++-v3/ChangeLog index a1d06b6fff17..57dde8c5533c 100644 --- a/libstdc++-v3/ChangeLog +++ b/libstdc++-v3/ChangeLog @@ -1,3 +1,13 @@ +2020-05-12 Jonathan Wakely + + Backport from mainline + 2020-05-04 Jonathan Wakely + + PR libstdc++/94906 + * src/c++17/memory_resource.cc + (monotonic_buffer_resource::_Chunk::release): Use size_t for shift + operands. + 2020-05-07 Eric Botcazou * config/abi/post/sparc64-linux-gnu/baseline_symbols.txt: Update. diff --git a/libstdc++-v3/src/c++17/memory_resource.cc b/libstdc++-v3/src/c++17/memory_resource.cc index e28526d1bfed..f39360cb4bf4 100644 --- a/libstdc++-v3/src/c++17/memory_resource.cc +++ b/libstdc++-v3/src/c++17/memory_resource.cc @@ -228,8 +228,8 @@ namespace pmr if (__ch->_M_canary != (__ch->_M_size | __ch->_M_align)) return; // buffer overflow detected! - size_t __size = (1u << __ch->_M_size); - size_t __align = (1u << __ch->_M_align); + size_t __size = (size_t)1 << __ch->_M_size; + size_t __align = (size_t)1 << __ch->_M_align; void* __start = (char*)(__ch + 1) - __size; __r->deallocate(__start, __size, __align); } -- 2.47.3