You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by GitBox <gi...@apache.org> on 2021/11/01 07:25:54 UTC
[GitHub] [incubator-nuttx] GUIDINGLI opened a new pull request #4765: mm: fix realloc overwrite memcpy when use a new block
GUIDINGLI opened a new pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765
## Summary
mm: fix realloc overwrite memcpy when use a new block
## Impact
mm
## Testing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 commented on pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 commented on pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#issuecomment-956169789
This patch need cherry-pick to 10.2 to avoid the buffer overflow error.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 commented on pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 commented on pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#issuecomment-956495504
BTW, this bug is actually found by KASAN: https://github.com/apache/incubator-nuttx/pull/4743.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] Ouss4 commented on a change in pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
Ouss4 commented on a change in pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#discussion_r740159758
##########
File path: mm/mm_heap/mm_realloc.c
##########
@@ -355,7 +355,7 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem,
newmem = (FAR void *)mm_malloc(heap, size);
if (newmem)
{
- memcpy(newmem, oldmem, oldsize);
+ memcpy(newmem, oldmem, oldsize - SIZEOF_MM_ALLOCNODE);
Review comment:
was the following `free` failing here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] Ouss4 commented on a change in pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
Ouss4 commented on a change in pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#discussion_r740431391
##########
File path: mm/mm_heap/mm_realloc.c
##########
@@ -355,7 +355,7 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem,
newmem = (FAR void *)mm_malloc(heap, size);
if (newmem)
{
- memcpy(newmem, oldmem, oldsize);
+ memcpy(newmem, oldmem, oldsize - SIZEOF_MM_ALLOCNODE);
Review comment:
Ah I see, I thought we are messing wit the memory that's going to be freed, it's actually the other pointer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 merged pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 merged pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 merged pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 merged pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 commented on pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 commented on pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#issuecomment-956495504
BTW, this bug is actually found by KASAN: https://github.com/apache/incubator-nuttx/pull/4743.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] Ouss4 commented on a change in pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
Ouss4 commented on a change in pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#discussion_r740431391
##########
File path: mm/mm_heap/mm_realloc.c
##########
@@ -355,7 +355,7 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem,
newmem = (FAR void *)mm_malloc(heap, size);
if (newmem)
{
- memcpy(newmem, oldmem, oldsize);
+ memcpy(newmem, oldmem, oldsize - SIZEOF_MM_ALLOCNODE);
Review comment:
Ah I see, I thought we are messing wit the memory that's going to be freed, it's actually the other pointer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 merged pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 merged pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-nuttx] xiaoxiang781216 commented on a change in pull request #4765: mm: fix realloc overwrite memcpy when use a new block
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 commented on a change in pull request #4765:
URL: https://github.com/apache/incubator-nuttx/pull/4765#discussion_r740186030
##########
File path: mm/mm_heap/mm_realloc.c
##########
@@ -355,7 +355,7 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem,
newmem = (FAR void *)mm_malloc(heap, size);
if (newmem)
{
- memcpy(newmem, oldmem, oldsize);
+ memcpy(newmem, oldmem, oldsize - SIZEOF_MM_ALLOCNODE);
Review comment:
No, the problem isn't fee, but memcpy. oldsize include the house keeping data(SIZEOF_MM_ALLOCNODE) before oldmem, memcpy with oldsize will overwrite SIZEOF_MM_ALLOCNODE bytes of the next region.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org