From patchwork Wed May 31 08:43:53 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Istvan Kurucsai X-Patchwork-Id: 768986 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3wd3wf5R56z9s7j for ; Wed, 31 May 2017 18:46:10 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="Oqz7pPnt"; dkim-atps=neutral DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id:in-reply-to :references; q=dns; s=default; b=mGBu+qjGG0MtkuadlyHjhTUVhH94slR VKwSGNvJOZBA+/nnGiUAqsD+yjLnEUKREYTVzn0aVT6Ux4/yFCML2fHvsGiX6AIN zgQDfiXXnyKFF5L+sMng53AnNIEyuIqRvQhjBefWqwwtlYs10AucT9eSwpSfYikD ChGv8Bkk2eH0= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id:in-reply-to :references; s=default; bh=3XmNbeOFA8IIB76qFghLoBUWxGg=; b=Oqz7p Pnt30hOfda/xTtbI1Nrk/SQdVkXDxHj+IXJq7pImH5Y2zE7vv8pMT+iYOThwZ4Jg 4FsjhJHmpLGJMEm4HORsLq7XvUZmS9QK+xdzuMgY8alAuIIzXKBL0hyxKKJAjcZq eqQ//hBsXas0oGoaGd22yIRU48Q+50aFCv1qsA= Received: (qmail 108219 invoked by alias); 31 May 2017 08:44:35 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 106658 invoked by uid 89); 31 May 2017 08:44:32 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.0 required=5.0 tests=AWL, BAYES_00, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, RCVD_IN_SORBS_SPAM, SPF_PASS autolearn=ham version=3.3.2 spammy= X-HELO: mail-wr0-f194.google.com X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=ecHwBRuXFbNdyjA+IeuFzzuLfn6Ntd25/9kjFL51Zh8=; b=ccjY1YyKjOHrmciIoAqL/zLfttlcw/6wdWqpOpDQFvMchn1L7uSWrpdmkbwp6JaxjO 7xId3AUiBQEnwp1+D6eVEHPPC6zqRvvMT9CzwVHsOPBHBEAkqCEJF/a5OwsV5FeILIc8 aVu+WlajnvaUVJRK89Wvy8mu9VS7rsJH3QMt7722GWezCFyGwjC1wzzNZ78PF4qtCQ9C ywirkJvuREti5hItlpjj17/3y8aoMMjQ0F3GIXIUV/y0a6A7l6K2tB1A4Bbz5pswoNYR z3sO2Xul9e8MuVm9o9epFD5poYTG/ph0uVETUX5xZgUtj21KC3UEMpMCrdZKSt8pFRmr M0jA== X-Gm-Message-State: AODbwcBT23AqbaBXz1K1JC0HI3c8caMqxne/mGR14Yi1OsJ2ZKM62k95 /rWZhRXmKbSlLXTSgrE= X-Received: by 10.223.134.216 with SMTP id 24mr12820653wry.31.1496220273092; Wed, 31 May 2017 01:44:33 -0700 (PDT) From: Istvan Kurucsai To: libc-alpha@sourceware.org Cc: Istvan Kurucsai Subject: [RFC][PATCH 5/7] malloc: Verify the integrity of mmapped chunks in calloc. Date: Wed, 31 May 2017 10:43:53 +0200 Message-Id: <1496220235-12750-6-git-send-email-pistukem@gmail.com> In-Reply-To: <1496220235-12750-1-git-send-email-pistukem@gmail.com> References: <1496220235-12750-1-git-send-email-pistukem@gmail.com> * malloc/malloc.c (__libc_calloc): Check mmapped chunks. --- malloc/malloc.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/malloc/malloc.c b/malloc/malloc.c index 424c69d..f0c54fa 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3260,6 +3260,19 @@ __libc_calloc (size_t n, size_t elem_size) /* Two optional cases in which clearing not necessary */ if (chunk_is_mmapped (p)) { + size_t pagesize = GLRO (dl_pagesize); + INTERNAL_SIZE_T offset = prev_size (p); + INTERNAL_SIZE_T size = chunksize (p); + uintptr_t block = (uintptr_t) p - offset; + size_t total_size = offset + size; + if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0 + || __glibc_unlikely (!powerof2 ((uintptr_t) mem & (pagesize - 1)))) + { + malloc_printerr (check_action, "calloc(): invalid mmapped chunk", + chunk2mem (p), NULL); + return 0; + } + if (__builtin_expect (perturb_byte, 0)) return memset (mem, 0, sz);