Skip to content

Commit 4450464

Browse files
committed
Add integer overflow check to the malloc wrappers
Add a check that the combined size of the buffer to allocate and alloc_info_t does not exceed the maximum integer value representable by size_t.
1 parent 866855d commit 4450464

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

platform/source/mbed_alloc_wrappers.cpp

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,10 @@ extern "C" void *malloc_wrapper(struct _reent *r, size_t size, void *caller)
114114
#endif
115115
#if MBED_HEAP_STATS_ENABLED
116116
malloc_stats_mutex->lock();
117-
alloc_info_t *alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
117+
alloc_info_t *alloc_info = NULL;
118+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
119+
alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
120+
}
118121
if (alloc_info != NULL) {
119122
alloc_info->size = size;
120123
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;
@@ -301,7 +304,10 @@ extern "C" void *malloc_wrapper(size_t size, void *caller)
301304
#endif
302305
#if MBED_HEAP_STATS_ENABLED
303306
malloc_stats_mutex->lock();
304-
alloc_info_t *alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
307+
alloc_info_t *alloc_info = NULL;
308+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
309+
alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
310+
}
305311
if (alloc_info != NULL) {
306312
alloc_info->size = size;
307313
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;

0 commit comments

Comments
 (0)