Skip to content

Commit 7a87902

Browse files
authored
[scudo] Fix stack depot validation. (#87024)
In the StackDepot::isValid function, there is work to validate the TabMask variable. Unfortunately, if TabMask is set to the maximum allowed value, TabSize = TabMask + 1 becomes zero and validation passes. Disallow that case to prevent invalid reads into the Tab structure.
1 parent 07a1fbe commit 7a87902

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

compiler-rt/lib/scudo/standalone/stack_depot.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ class alignas(atomic_u64) StackDepot {
112112
if (TabMask == 0)
113113
return false;
114114
uptr TabSize = TabMask + 1;
115-
if (!isPowerOfTwo(TabSize))
115+
if (TabSize == 0 || !isPowerOfTwo(TabSize))
116116
return false;
117117
uptr TabBytes = sizeof(atomic_u32) * TabSize;
118118

0 commit comments

Comments
 (0)