From nobody Fri Dec 26 05:27:49 2025 Received: from mail-oi1-f176.google.com (mail-oi1-f176.google.com [209.85.167.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 606ACC142 for ; Tue, 9 Jan 2024 23:44:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UnEp/OBW" Received: by mail-oi1-f176.google.com with SMTP id 5614622812f47-3bbc755167fso3223712b6e.0 for ; Tue, 09 Jan 2024 15:44:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1704843845; x=1705448645; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=WDzSgBLqbfjMZPUPpyZDUP7UU1l75Pn8NaJbhwNgX2k=; b=UnEp/OBW+B3TIESbmYvAUySW6cAdoWSH1gnhvwnANUfwL0NYy6FCV03Y+2Cdh33sWP 031mWFIAVdv6B730zze2LU+SYl3RVMVEgBo4Sh+zR7MwcoJcnTUPXDXiEBE2gXHtFNtd y4809XDwI2mtCa/wDYtpj1AvBdtaRojaMeawMYKMVQ72PcNA2sgPNYuhaXLu/32EH8N5 l08qoqVSdVJ7Pae1tQ2MAUEBHgKiTfs2t2r7kOaH63PXVIjdSeFO487tFCfUM79NJ0sJ oQjMShbNGOJ3eVRcxj/g9tNQgSa2RAuc8n7gM/dK8op5uLuuXnfmycQPXLVlMgOc0LK7 ApIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704843845; x=1705448645; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=WDzSgBLqbfjMZPUPpyZDUP7UU1l75Pn8NaJbhwNgX2k=; b=F0OHsou3dHu0PmAMBDKd2U8015s44fTIM1tBwMPUwuUIi7+vkD+npdzqgWU4dVw2QM EfwYTFr7SbIXjBynSy6eUapbmrcJ/qLoaTnmj4pPabMIKFQ2X7cBr0dWzYzbi8smvZvN /kqiGgW2NWqdo6iH4VhjMEBQRDQ1Z/f/U9F4uvB6jP0j5NZg8cTNvZIVpTeNCd7pi8Ve A6rqo5+4LJfFJsIBddj5wBngQoXU56nrA+TfeINt4pEs6sKOzkxD81gxG9cZwM8aTR2s SkICgnQuLmfsHZrvNv0NFoidlQy3E6L6QB2aMTvOjYNbjlQerdtTvBcguZZVyy4+aFBy I4yQ== X-Gm-Message-State: AOJu0YzAw9JbW3NGpFZIpT5esAWf2OfPy/xPrmXHjlElGKfuKE5FelkC Ph/yGDvUG7wJipxP5mSfhKg= X-Google-Smtp-Source: AGHT+IEmYCqYOqp7Odv/O1n9QDOcKeNQJsi0xZpvXJVCsep+CyzBbzudX1SU/TIFl93kG06ZwLcYIA== X-Received: by 2002:a05:6808:1209:b0:3bb:d83a:99a8 with SMTP id a9-20020a056808120900b003bbd83a99a8mr187720oil.58.1704843845345; Tue, 09 Jan 2024 15:44:05 -0800 (PST) Received: from mizu (142-255-118-068.res.spectrum.com. [142.255.118.68]) by smtp.gmail.com with ESMTPSA id kj1-20020a056214528100b0067f4e2ad746sm1287050qvb.44.2024.01.09.15.44.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jan 2024 15:44:04 -0800 (PST) Date: Tue, 9 Jan 2024 18:44:02 -0500 From: Brennan Xavier McManus To: Willy Tarreau Cc: Thomas =?iso-8859-1?Q?Wei=DFschuh?= , Ammar Faizi , Linux Kernel Mailing List Subject: [PATCH] tools/nolibc/stdlib: fix memory error in realloc() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region. Signed-off-by: Brennan Xavier McManus Reviewed-by: Ammar Faizi --- All tests from Ammar's original test program pass: https://gist.github.com/ammarfaizi2/db0af6aa0b95a0c7478bce64e349f021 This fix was tested with the following added test for realloc(): https://github.com/brennan913/nolibc-test/blob/main/nolibc_test.c#L73-L120 tools/include/nolibc/stdlib.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/include/nolibc/stdlib.h b/tools/include/nolibc/stdlib.h index bacfd35c5156..5be9d3c7435a 100644 --- a/tools/include/nolibc/stdlib.h +++ b/tools/include/nolibc/stdlib.h @@ -185,7 +185,7 @@ void *realloc(void *old_ptr, size_t new_size) if (__builtin_expect(!ret, 0)) return NULL; =20 - memcpy(ret, heap->user_p, heap->len); + memcpy(ret, heap->user_p, user_p_len); munmap(heap, heap->len); return ret; } --=20 2.39.2