Skip to content

Commit 791f464

Browse files
Brennan Xavier McManust-8ch
authored andcommitted
tools/nolibc/stdlib: fix memory error in realloc()
Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region. Signed-off-by: Brennan Xavier McManus <bxmcmanus@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Ammar Faizi <ammarfaizi2@gnuweeb.org> Fixes: 0e0ff63 ("tools/nolibc/stdlib: Implement `malloc()`, `calloc()`, `realloc()` and `free()`") Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
1 parent 4cece76 commit 791f464

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

tools/include/nolibc/stdlib.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ void *realloc(void *old_ptr, size_t new_size)
185185
if (__builtin_expect(!ret, 0))
186186
return NULL;
187187

188-
memcpy(ret, heap->user_p, heap->len);
188+
memcpy(ret, heap->user_p, user_p_len);
189189
munmap(heap, heap->len);
190190
return ret;
191191
}

0 commit comments

Comments
 (0)