Skip to content

Commit 3742e34

Browse files
authored
Merge pull request #14407 from LDong-Arm/malloc_wrapper_fix
Add integer overflow check to the malloc wrappers
2 parents 5326e30 + 4450464 commit 3742e34

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

platform/source/mbed_alloc_wrappers.cpp

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,10 @@ extern "C" void *malloc_wrapper(struct _reent *r, size_t size, void *caller)
114114
#endif
115115
#if MBED_HEAP_STATS_ENABLED
116116
malloc_stats_mutex->lock();
117-
alloc_info_t *alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
117+
alloc_info_t *alloc_info = NULL;
118+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
119+
alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
120+
}
118121
if (alloc_info != NULL) {
119122
alloc_info->size = size;
120123
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;
@@ -301,7 +304,10 @@ extern "C" void *malloc_wrapper(size_t size, void *caller)
301304
#endif
302305
#if MBED_HEAP_STATS_ENABLED
303306
malloc_stats_mutex->lock();
304-
alloc_info_t *alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
307+
alloc_info_t *alloc_info = NULL;
308+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
309+
alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
310+
}
305311
if (alloc_info != NULL) {
306312
alloc_info->size = size;
307313
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;

0 commit comments

Comments
 (0)