Check that the size passed to memalign() is not greater than PTRDIFF_MAX
before adjusting it, otherwise it may wrap around in the adjustment.
This fixes gcc testsuite test gcc.dg/torture/pr60092.c
Signed-off-by: Max Filippov <jcmvb...@gmail.com>
---
libc/stdlib/malloc/memalign.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libc/stdlib/malloc/memalign.c b/libc/stdlib/malloc/memalign.c
index 665f20cfbfab..a77b8cebcde7 100644
--- a/libc/stdlib/malloc/memalign.c
+++ b/libc/stdlib/malloc/memalign.c
@@ -38,6 +38,11 @@ memalign (size_t alignment, size_t size)
unsigned long tot_addr, tot_end_addr, addr, end_addr;
struct heap_free_area **heap = &__malloc_heap;
+ if (unlikely(size > PTRDIFF_MAX)) {
+ __set_errno(ENOMEM);
+ return NULL;
+ }
+
/* Make SIZE something we like. */
size = HEAP_ADJUST_SIZE (size);
--
2.39.2
_______________________________________________
devel mailing list -- devel@uclibc-ng.org
To unsubscribe send an email to devel-le...@uclibc-ng.org
