From 196911d4fad0b42272be06d40adcbb53f755b19d Mon Sep 17 00:00:00 2001 From: EunBong Song Date: Tue, 17 Oct 2017 06:37:09 -0600 Subject: [PATCH] If size is greater than (UINT32_MAX - SIZEOF_MM_ALLOCNODE), malloc size can be overflow by MM_ALIGN_UP macro. For example, if task_create() called with stack_size == -1, up_create_stack() functions allocates SIZEOF_MM_ALLOCNODE bytes for stack. This can cause data abort in up_stack_color() function. --- mm/mm_heap/mm_malloc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/mm_heap/mm_malloc.c b/mm/mm_heap/mm_malloc.c index 3efa15259f7..98b9cac2443 100644 --- a/mm/mm_heap/mm_malloc.c +++ b/mm/mm_heap/mm_malloc.c @@ -1,7 +1,8 @@ /**************************************************************************** * mm/mm_heap/mm_malloc.c * - * Copyright (C) 2007, 2009, 2013-2014 Gregory Nutt. All rights reserved. + * Copyright (C) 2007, 2009, 2013-2014, 2017 Gregory Nutt. All rights + * reserved. * Author: Gregory Nutt * * Redistribution and use in source and binary forms, with or without @@ -75,7 +76,11 @@ FAR void *mm_malloc(FAR struct mm_heap_s *heap, size_t size) /* Handle bad sizes */ - if (size < 1) +#ifndef CONFIG_MM_SMALL + if (size < 1 || size > (UINT32_MAX - SIZEOF_MM_ALLOCNODE)) +#else + if (size < 1 || size > (UINT16_MAX - SIZEOF_MM_ALLOCNODE)) +#endif { return NULL; }