[uclibc-ng-devel] [PATCH] malloc/memalign: avoid integer overflow

Check that the size passed to memalign() is not greater than PTRDIFF_MAX before adjusting it, otherwise it may wrap around in the adjustment. This fixes gcc testsuite test gcc.dg/torture/pr60092.c Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com> --- libc/stdlib/malloc/memalign.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libc/stdlib/malloc/memalign.c b/libc/stdlib/malloc/memalign.c index 665f20cfbfab..a77b8cebcde7 100644 --- a/libc/stdlib/malloc/memalign.c +++ b/libc/stdlib/malloc/memalign.c @@ -38,6 +38,11 @@ memalign (size_t alignment, size_t size) unsigned long tot_addr, tot_end_addr, addr, end_addr; struct heap_free_area **heap = &__malloc_heap; + if (unlikely(size > PTRDIFF_MAX)) { + __set_errno(ENOMEM); + return NULL; + } + /* Make SIZE something we like. */ size = HEAP_ADJUST_SIZE (size); -- 2.39.2