Null-pointer dereference bug in nano-malloc

Cyril Yared <[email protected]>
Newsgroups gmane.comp.lib.newlib
Message-ID <CAFq0=_MsCp0=AaHENtW=idrD4Z=PYX40ybJnyY85_qZ4urdN0g@mail.gmail.com>
Hi,
It appears that commit 84d068971 introduced a null-pointer dereference in
nano-malloc when the following two conditions are met:

1). The free_list has no items (= NULL).
2). The call to sbrk_aligned returns -1 (failure).

On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:

if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{

If the two conditions are met, then p = free_list = NULL so p->size will be
a null-pointer dereference. Is this something that's known/being tracked
anywhere?
Cyril
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.