Null-pointer dereference bug in nano-malloc
Cyril Yared <[email protected]>
| Newsgroups | gmane.comp.lib.newlib |
|---|---|
| Message-ID | <CAFq0=_MsCp0=AaHENtW=idrD4Z=PYX40ybJnyY85_qZ4urdN0g@mail.gmail.com> |
Hi,
It appears that commit 84d068971 introduced a null-pointer dereference in
nano-malloc when the following two conditions are met:
1). The free_list has no items (= NULL).
2). The call to sbrk_aligned returns -1 (failure).
On line 325 of newlib/libc/stdlib/nano-mallocr.c, there is a check:
if ((char *)p + p->size == (char *)_SBRK_R(RCALL 0))
{
If the two conditions are met, then p = free_list = NULL so p->size will be
a null-pointer dereference. Is this something that's known/being tracked
anywhere?
Cyril