dlmalloc: Fix integer overflow in request2size()
authorRichard Weinberger <richard@nod.at>
Fri, 2 Aug 2024 10:08:44 +0000 (12:08 +0200)
committerDaniel Leidert <dleidert@debian.org>
Wed, 30 Apr 2025 23:19:02 +0000 (01:19 +0200)
commitc3cd6b637d84cbbc37ee6361f6904663ecbda05c
tree04e61eb3a111b14f754fe49f483e4b25d8930052
parentf5ebb456128bfef3d142e34b562d5eeb7ffaa1f1
dlmalloc: Fix integer overflow in request2size()

req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.

Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f
Bug: https://www.openwall.com/lists/oss-security/2025/02/17/2
Bug-Debian: https://bugs.debian.org/1098254
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-57258
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2024-57258

Gbp-Pq: Name CVE-2024-57258-2.patch
common/dlmalloc.c