3350. [bug] Memory read overrun in isc___mem_reallocate if

                        ISC_MEM_DEBUGCTX memory debugging flag is set.
                        [RT #30240]

diff --git a/CHANGES b/CHANGES
index 361e036b225666bc788883f71bdccbca75cf6c80..4b4082548d68856f3d7ccdbccdb3005a2bf3b311 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3350.  [bug]           Memory read overrun in isc___mem_reallocate if
+                       ISC_MEM_DEBUGCTX memory debugging flag is set.
+                       [RT #30240]
+
 3349.  [bug]           Change #3345 was incomplete. [RT #30233]
 
 3348.  [security]      prevent RRSIG data from being cached if a negative 

diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index fd9c3f94ddaca45e00b0046e8909a00f1998352e..fe3ade0fb40a0deeed8436685a1224726c74c366 100644 (file)
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -1598,7 +1598,11 @@ isc___mem_reallocate(isc_mem_t *ctx0, void *ptr, size_t size FLARG) {
                        oldsize = (((size_info *)ptr)[-1]).u.size;
                        INSIST(oldsize >= ALIGNMENT_SIZE);
                        oldsize -= ALIGNMENT_SIZE;
-                       copysize = oldsize > size ? size : oldsize;
+                       if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0) {
+                               INSIST(oldsize >= ALIGNMENT_SIZE);
+                               oldsize -= ALIGNMENT_SIZE;
+                       }
+                       copysize = (oldsize > size) ? size : oldsize;
                        memcpy(new_ptr, ptr, copysize);
                        isc__mem_free(ctx0, ptr FLARG_PASS);
                }