Author: davidxu
Date: Fri Feb 21 03:36:16 2014
New Revision: 262277
URL: http://svnweb.freebsd.org/changeset/base/262277
Log:
malloc_aligned() may not leave enough space for pointer to allocated memory,
saving the pointer will overwrite bytes belongs to another memory block
unexpectly, to fix the problem, use (allocated address + sizeof(void *)) as
initial value, and slip to next aligned address, so maximum extra bytes is
sizeof(void *) + align - 1.
Tested by: Andre Albsmeier < mail at ma17 dot ata dot myota dot orgndre >
Modified:
head/libexec/rtld-elf/xmalloc.c
Modified: head/libexec/rtld-elf/xmalloc.c
==============================================================================
--- head/libexec/rtld-elf/xmalloc.c Fri Feb 21 03:35:43 2014
(r262276)
+++ head/libexec/rtld-elf/xmalloc.c Fri Feb 21 03:36:16 2014
(r262277)
@@ -72,14 +72,14 @@ void *
malloc_aligned(size_t size, size_t align)
{
void *mem, *res;
- uintptr_t x;
- size_t asize, r;
- r = round(sizeof(void *), align);
- asize = round(size, align) + r;
- mem = xmalloc(asize);
- x = (uintptr_t)mem;
- res = (void *)round(x, align);
+ if (align & (sizeof(void *) -1)) {
+ rtld_fdputstr(STDERR_FILENO, "Invalid alignment\n");
+ _exit(1);
+ }
+
+ mem = xmalloc(size + sizeof(void *) + align - 1);
+ res = (void *)round((uintptr_t)mem + sizeof(void *), align);
*(void **)((uintptr_t)res - sizeof(void *)) = mem;
return (res);
}
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
