]> git.dujemihanovic.xyz Git - u-boot.git/commit
dlmalloc: Fix integer overflow in request2size()
authorRichard Weinberger <richard@nod.at>
Fri, 2 Aug 2024 10:08:44 +0000 (12:08 +0200)
committerTom Rini <trini@konsulko.com>
Thu, 15 Aug 2024 22:14:36 +0000 (16:14 -0600)
commit8642b2178d2c4002c99a0b69a845a48f2ae2706f
treeb96d09d1a763e9e3d0bc9142def8d40be9d67349
parentc17b2a05dd50a3ba437e6373093a0d6a359cdee0
dlmalloc: Fix integer overflow in request2size()

req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.

Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
common/dlmalloc.c