This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 8156f7abe61a8f1817f31ddf134e79097dda12be Author: Marco Casaroli <[email protected]> AuthorDate: Fri Oct 30 07:52:04 2026 +0100 mm: Make mm_malloc_size() return 0 for NULL in every heap. The default heap returned 0 for NULL, but TLSF did not: with CONFIG_MM_BACKTRACE >= 0, it subtracted the backtrace size from 0 and returned a value near SIZE_MAX. With CONFIG_MM_HEAP_MEMPOOL, both heaps gave NULL to mempool_multiple_alloc_size(), which asserts that the block is not NULL. The default heap also returned for NULL without the restore of kasan_bypass(). Check NULL first in both heaps, so that malloc_size(), kmm_malloc_size() and the other wrappers return 0 for NULL in every configuration. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- mm/mm_heap/mm_malloc_size.c | 14 +++++++------- mm/tlsf/mm_tlsf.c | 7 +++++++ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/mm/mm_heap/mm_malloc_size.c b/mm/mm_heap/mm_malloc_size.c index 2c5100f0702..18ea90bded0 100644 --- a/mm/mm_heap/mm_malloc_size.c +++ b/mm/mm_heap/mm_malloc_size.c @@ -44,6 +44,13 @@ size_t mm_malloc_size(FAR struct mm_heap_s *heap, FAR void *mem) ssize_t size; bool flag; + /* Protect against attempts to query a NULL reference */ + + if (mem == NULL) + { + return 0; + } + flag = kasan_bypass(true); #ifdef CONFIG_MM_HEAP_MEMPOOL if (heap->mm_mpool) @@ -57,13 +64,6 @@ size_t mm_malloc_size(FAR struct mm_heap_s *heap, FAR void *mem) } #endif - /* Protect against attempts to query a NULL reference */ - - if (!mem) - { - return 0; - } - /* Map the memory chunk into a free node */ node = (FAR struct mm_freenode_s *)((FAR char *)mem - MM_SIZEOF_ALLOCNODE); diff --git a/mm/tlsf/mm_tlsf.c b/mm/tlsf/mm_tlsf.c index 957ce1e10b0..2e50903708f 100644 --- a/mm/tlsf/mm_tlsf.c +++ b/mm/tlsf/mm_tlsf.c @@ -1348,6 +1348,13 @@ void mm_memdump(FAR struct mm_heap_s *heap, size_t mm_malloc_size(FAR struct mm_heap_s *heap, FAR void *mem) { + /* Protect against attempts to query a NULL reference */ + + if (mem == NULL) + { + return 0; + } + #ifdef CONFIG_MM_HEAP_MEMPOOL if (heap->mm_mpool) {
