[klibc] malloc: Fail if requested size > PTRDIFF_MAX
authorBen Hutchings <ben@decadent.org.uk>
Wed, 28 Apr 2021 02:03:49 +0000 (04:03 +0200)
committerThorsten Glaser <tg@mirbsd.de>
Wed, 26 May 2021 22:12:10 +0000 (23:12 +0100)
commiteb80eb61e064fd62f1eff968d9d6558eb36d1f0b
tree0ebc8f3ee1b76ded9c916c4083f1ae1b2963f0c8
parent0939d365798dfb12f67f28311015cbabb5d2255f
[klibc] malloc: Fail if requested size > PTRDIFF_MAX

Origin: https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-31873

malloc() adds some overhead to the requested size, which may result in
an integer overflow and subsequent buffer overflow if it is close to
SIZE_MAX.  It should fail if size is large enough for this to happen.

Further, it's not legal for a C object to be larger than
PTRDIFF_MAX (half of SIZE_MAX) as pointer arithmetic within it could
overflow.  So return failure immediately if size is greater than that.

CVE-2021-31873

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0036-klibc-malloc-Fail-if-requested-size-PTRDIFF_MAX.patch
usr/klibc/malloc.c