diff options
| author | Brennan Xavier McManus <bxmcmanus@gmail.com> | 2024-01-10 02:44:02 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-06-12 12:11:19 +0300 |
| commit | f678c3c336559cf3255a32153e9a17c1be4e7c15 (patch) | |
| tree | 05991232c248640a0ccb85aa5ba073403586ba3b /tools/include | |
| parent | 64f0c3bd2dd74700e7acde1d73d3bc1d99c6b5a8 (diff) | |
| download | linux-f678c3c336559cf3255a32153e9a17c1be4e7c15.tar.xz | |
tools/nolibc/stdlib: fix memory error in realloc()
commit 791f4641142e2aced85de082e5783b4fb0b977c2 upstream.
Pass user_p_len to memcpy() instead of heap->len to prevent realloc()
from copying an extra sizeof(heap) bytes from beyond the allocated
region.
Signed-off-by: Brennan Xavier McManus <bxmcmanus@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
Fixes: 0e0ff638400be8f497a35b51a4751fd823f6bd6a ("tools/nolibc/stdlib: Implement `malloc()`, `calloc()`, `realloc()` and `free()`")
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/include')
| -rw-r--r-- | tools/include/nolibc/stdlib.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/include/nolibc/stdlib.h b/tools/include/nolibc/stdlib.h index bacfd35c5156..5be9d3c7435a 100644 --- a/tools/include/nolibc/stdlib.h +++ b/tools/include/nolibc/stdlib.h @@ -185,7 +185,7 @@ void *realloc(void *old_ptr, size_t new_size) if (__builtin_expect(!ret, 0)) return NULL; - memcpy(ret, heap->user_p, heap->len); + memcpy(ret, heap->user_p, user_p_len); munmap(heap, heap->len); return ret; } |