In the rallocx() shim for OpenBSD (that's the only platform that doesn't
have malloc_size() or malloc_usable_size() equivalent), the newly
allocated size was missing the extra size_t member for storing the
allocation size leading to size_t sized overflow at the end of the
reallocated memory chunk.
rallocx(void *ptr, size_t size, int flags) {
UNUSED(flags);
- size_t *__ptr = realloc(&((size_t *)ptr)[-1], size);
+ size_t *__ptr = realloc(&((size_t *)ptr)[-1], size + sizeof(size_t));
REQUIRE(__ptr != NULL);
__ptr[0] = size;