diff mbox series

[v2,2/2] malloc: Fix a potential realloc issue with memory tagging

Message ID ce3bbe19aef9d215a6f854233dc9cde921ea0c3a.1615483341.git.szabolcs.nagy@arm.com
State New
Headers show
Series malloc: split the mtag realloc fix patch | expand

Commit Message

Szabolcs Nagy March 11, 2021, 5:57 p.m. UTC 
At an _int_free call site in realloc the wrong size was used for tag
clearing: the chunk header of the next chunk was also cleared which
in practice may work, but logically wrong.

The tag clearing is moved before the memcpy to save a tag computation,
this avoids a chunk2mem.  Another chunk2mem is removed because newmem
does not have to be recomputed. Whitespaces got fixed too.
---
 malloc/malloc.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 8f8f12c276..51cec67e55 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4851,14 +4851,14 @@  _int_realloc(mstate av, mchunkptr oldp, INTERNAL_SIZE_T oldsize,
             }
           else
             {
-	      void *oldmem = chunk2mem (oldp);
+	      void *oldmem = chunk2rawmem (oldp);
+	      size_t sz = CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ;
+	      (void) TAG_REGION (oldmem, sz);
 	      newmem = TAG_NEW_USABLE (newmem);
-	      memcpy (newmem, oldmem,
-		      CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ);
-	      (void) TAG_REGION (chunk2rawmem (oldp), oldsize);
-              _int_free (av, oldp, 1);
-              check_inuse_chunk (av, newp);
-              return chunk2mem (newp);
+	      memcpy (newmem, oldmem, sz);
+	      _int_free (av, oldp, 1);
+	      check_inuse_chunk (av, newp);
+	      return newmem;
             }
         }
     }