[PATCH master] dlmalloc: Fix integer overflow in request2size()

[PATCH master] dlmalloc: Fix integer overflow in request2size()

[Ahmad Fatoum]

From: Richard Weinberger <richard@nod.at>

req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.

Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.

Signed-off-by: Richard Weinberger <richard@nod.at>
Link: https://lore.barebox.org/barebox/2561107.TLnPLrj5Ze@somecomputer/
Link: https://lore.kernel.org/all/20240802100846.16619-2-richard@nod.at/
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/dlmalloc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index f92863f180d5..0ec7114c89d7 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -641,8 +641,8 @@ static inline mchunkptr mem2chunk(void *mem)
 /* pad request bytes into a usable size */
 
 #define request2size(req) \
- (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
-  (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
+ ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
+  (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
    (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK)))
 
 /* Check if m has acceptable alignment */
-- 
2.39.5

Re: [PATCH master] dlmalloc: Fix integer overflow in request2size()

[Sascha Hauer]

On Tue, 19 Nov 2024 08:15:25 +0100, Ahmad Fatoum wrote:
> req is of type size_t, casting it to long opens the door
> for an integer overflow.
> Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
> cause and overflow such that request2size() returns MINSIZE.
> 
> Fix by removing the cast.
> The origin of the cast is unclear, it's in u-boot and ppcboot since ever
> and predates the CVS history.
> Doug Lea's original dlmalloc implementation also doesn't have it.
> 
> [...]

Applied, thanks!

[1/1] dlmalloc: Fix integer overflow in request2size()
      https://git.pengutronix.de/cgit/barebox/commit/?id=7cf25e0733f0 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>