File 0043-dlmalloc-Fix-integer-overflow-in-s-.patch of Package u-boot.37699
From 5119269f0113a5df81d0a85e21519bed6f0ddfdb Mon Sep 17 00:00:00 2001 From: Richard Weinberger <richard@nod.at> Date: Fri, 2 Aug 2024 12:08:45 +0200 Subject: [PATCH] dlmalloc: Fix integer overflow in sbrk() Make sure that the new break is within mem_malloc_start and mem_malloc_end before making progress. ulong new = old + increment; can overflow for extremely large increment values and memset() can get wrongly called. Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Simon Glass <sjg@chromium.org> (cherry picked from 0a10b49206a29b4aa2f80233a3e53ca0466bb0b3) Signed-off-by: Andrea della Porta <andrea.porta@suse.com> --- common/dlmalloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/common/dlmalloc.c b/common/dlmalloc.c index b29a7cfd..16fe49d0 100644 --- a/common/dlmalloc.c +++ b/common/dlmalloc.c @@ -589,6 +589,9 @@ void *sbrk(ptrdiff_t increment) ulong old = mem_malloc_brk; ulong new = old + increment; + if ((new < mem_malloc_start) || (new > mem_malloc_end)) + return (void *)MORECORE_FAILURE; + /* * if we are giving memory back make sure we clear it out since * we set MORECORE_CLEARS to 1 @@ -596,9 +599,6 @@ void *sbrk(ptrdiff_t increment) if (increment < 0) memset((void *)new, 0, -increment); - if ((new < mem_malloc_start) || (new > mem_malloc_end)) - return (void *)MORECORE_FAILURE; - mem_malloc_brk = new; return (void *)old; -- 2.35.3
