| commit | 42cc96066b22ba065db11096c78881a55e45def4 | |
| author | Szabolcs Nagy <szabolcs.nagy@arm.com> | |
| Thu, 25 Feb 2021 14:49:58 +0000 (25 14:49 +0000) | ||
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | |
| Fri, 26 Mar 2021 10:43:51 +0000 (26 10:43 +0000) | ||
| tree | 806136a0e5fe76b6e811810f6626a11753260dca | treesnapshot (tar.gz zip) |
| parent | 7759be2593b689cb1eafc0f52ee7f59c639e5d2f | commitdiff |
malloc: Fix a realloc crash with heap tagging [BZ 27468]
_int_free must be called with a chunk that has its tag reset. This was
missing in a rare case that could crash when heap tagging is enabled:
when in a multi-threaded process the current arena runs out of memory
during realloc, but another arena still has space to finish the realloc
then _int_free was called without clearing the user allocation tags.
Fixes bug 27468.
Reviewed-by: DJ Delorie <dj@redhat.com>
_int_free must be called with a chunk that has its tag reset. This was
missing in a rare case that could crash when heap tagging is enabled:
when in a multi-threaded process the current arena runs out of memory
during realloc, but another arena still has space to finish the realloc
then _int_free was called without clearing the user allocation tags.
Fixes bug 27468.
Reviewed-by: DJ Delorie <dj@redhat.com>
| malloc/malloc.c | diffblobblamehistory |