[avr-libc-dev] [bug #53284] realloc() does not respect __freelist size for small allocations

[David Glaze]

URL:
<http://savannah.nongnu.org/bugs/?53284>

Summary: realloc() does not respect __freelist size for small
allocations
Project: AVR C Runtime Library
Submitted by: djglaze
Submitted on: Sun 04 Mar 2018 10:19:44 PM UTC
Category: Library
Severity: 3 - Normal
Priority: 5 - Normal
Item Group: libc code
Status: None
Percent Complete: 0%
Assigned to: None
Originator Email:
Open/Closed: Open
Discussion Lock: Any
Release: 2.0.0
Fixed Release: None

_______________________________________________________

Details:

The realloc() function does not respect the __freelist size when resizing an
allocation down to 0 or 1 bytes. If this allocation is then deallocated with
free(), a __freelist entry is placed in its slot that can partially overwrite
an adjacent allocation, leading to irrecoverable memory corruption. The
following code can reproduce the corruption:


// Relevant bytes in heap allocation shown in comments (User storage denoted
with 0xFF)
char * resizedVar = (char*)malloc(6); // 0x06 0x00 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF
resizedVar = (char*)realloc(resizedVar, 1); // 0x01 0x00 0xFF
char * fixedVar = (char*)malloc(4); // 0x01 0x00 0xFF 0x04 0x00 0xFF
0xFF 0xFF 0xFF
free(resizedVar); // 0x01 0x00 0x00 0x00 0x00 0xFF
0xFF 0xFF 0xFF
// ^ Size of
fixedVar overwritten


malloc() handles this issue with a minimum allocation size, so that requested
allocations of 0, 1, or 2 bytes all take the same storage. The same technique
can be used here to prevent problems, as shown in the attached patch.




_______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Sun 04 Mar 2018 10:19:44 PM UTC Name: realloc_small_size.patch Size:
614B By: djglaze

<http://savannah.nongnu.org/bugs/download.php?file_id=43463>

_______________________________________________________

Reply to this item at:

<http://savannah.nongnu.org/bugs/?53284>

_______________________________________________
Message sent via/by Savannah
http://savannah.nongnu.org/