Attachment 614014 Details for Bug 849693 – patch florian checked in

[patch] patch florian checked in

objallocpatch (text/plain), 1.71 KB, created by Jeff Law on 2012-09-18 13:09:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeff Law

Created: 2012-09-18 13:09:05 UTC

Size: 1.71 KB

patch

obsolete

>diff -Nrup libiberty/ChangeLog /home/gcc/gcc/libiberty/ChangeLog
>--- libiberty/ChangeLog	2012-09-18 06:59:25.138464679 -0600
>+++ /home/gcc/gcc/libiberty/ChangeLog	2012-09-18 07:00:17.678227450 -0600
>@@ -1,3 +1,9 @@
>+2012-09-18  Florian Weimer  <fweimer@redhat.com>
>+
>+	PR other/54411
>+	* objalloc.c (_objalloc_alloc): Add overflow check covering
>+	alignment and CHUNK_HEADER_SIZE addition.
>+
> 2011-08-28  H.J. Lu  <hongjiu.lu@intel.com>
> 
> 	* argv.c (dupargv): Replace malloc with xmalloc.  Don't check
>diff -Nrup libiberty/objalloc.c /home/gcc/gcc/libiberty/objalloc.c
>--- libiberty/objalloc.c	2012-09-18 06:59:25.203464385 -0600
>+++ /home/gcc/gcc/libiberty/objalloc.c	2012-09-18 07:00:18.965221638 -0600
>@@ -1,5 +1,5 @@
> /* objalloc.c -- routines to allocate memory for objects
>-   Copyright 1997 Free Software Foundation, Inc.
>+   Copyright 1997-2012 Free Software Foundation, Inc.
>    Written by Ian Lance Taylor, Cygnus Solutions.
> 
> This program is free software; you can redistribute it and/or modify it
>@@ -112,8 +112,10 @@ objalloc_create (void)
> /* Allocate space from an objalloc structure.  */
> 
> PTR
>-_objalloc_alloc (struct objalloc *o, unsigned long len)
>+_objalloc_alloc (struct objalloc *o, unsigned long original_len)
> {
>+  unsigned long len = original_len;
>+
>   /* We avoid confusion from zero sized objects by always allocating
>      at least 1 byte.  */
>   if (len == 0)
>@@ -121,6 +123,11 @@ _objalloc_alloc (struct objalloc *o, uns
> 
>   len = (len + OBJALLOC_ALIGN - 1) &~ (OBJALLOC_ALIGN - 1);
> 
>+  /* Check for overflow in the alignment operation above and the
>+     malloc argument below. */
>+  if (len + CHUNK_HEADER_SIZE < original_len)
>+    return NULL;
>+
>   if (len <= o->current_space)
>     {
>       o->current_ptr += len;

Actions: View | Diff

Attachments on bug 849693: 614014