fix heap corruption bug in memalign
[musl.git] / src / malloc / memalign.c
blobcb2324763c32b3492b77042faa319b1bb125c118
1 #include <stdlib.h>
2 #include <stdint.h>
3 #include <errno.h>
4 #include "libc.h"
6 /* This function should work with most dlmalloc-like chunk bookkeeping
7 * systems, but it's only guaranteed to work with the native implementation
8 * used in this library. */
10 void *__memalign(size_t align, size_t len)
12 unsigned char *mem, *new, *end;
13 size_t header, footer;
15 if ((align & -align) != align) {
16 errno = EINVAL;
17 return NULL;
20 if (len > SIZE_MAX - align) {
21 errno = ENOMEM;
22 return NULL;
25 if (align <= 4*sizeof(size_t)) {
26 if (!(mem = malloc(len)))
27 return NULL;
28 return mem;
31 if (!(mem = malloc(len + align-1)))
32 return NULL;
34 new = (void *)((uintptr_t)mem + align-1 & -align);
35 if (new == mem) return mem;
37 header = ((size_t *)mem)[-1];
39 if (!(header & 7)) {
40 ((size_t *)new)[-2] = ((size_t *)mem)[-2] + (new-mem);
41 ((size_t *)new)[-1] = ((size_t *)mem)[-1] - (new-mem);
42 return new;
45 end = mem + (header & -8);
46 footer = ((size_t *)end)[-2];
48 ((size_t *)mem)[-1] = header&7 | new-mem;
49 ((size_t *)new)[-2] = footer&7 | new-mem;
50 ((size_t *)new)[-1] = header&7 | end-new;
51 ((size_t *)end)[-2] = footer&7 | end-new;
53 if (new != mem) free(mem);
54 return new;
57 weak_alias(__memalign, memalign);