romenskiy2012/jemalloc
1
0
Fork 0
mirror of https://github.com/jemalloc/jemalloc.git synced 2026-07-23 09:07:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix off-by-one in arenas_bin_i_index and arenas_lextent_i_index bounds checks

Browse source 
The index validation used > instead of >=, allowing access at index
SC_NBINS (for bins) and SC_NSIZES-SC_NBINS (for lextents), which are
one past the valid range. This caused out-of-bounds reads in bin_infos[]
and sz_index2size_unsafe().

Add unit tests that verify the boundary indices return ENOENT.
This commit is contained in:
Slobodan Predolac 2026-03-27 08:42:54 -07:00
parent 176ea0a801
commit 513778bcb1
2 changed files with 49 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ctl.c
View file

@ -3250,7 +3250,7 @@ CTL_RO_NL_GEN(arenas_bin_i_slab_size, bin_infos[mib[2]].slab_size, size_t)
CTL_RO_NL_GEN(arenas_bin_i_nshards, bin_infos[mib[2]].n_shards, uint32_t)
static const ctl_named_node_t *
arenas_bin_i_index(tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t i) {
if (i > SC_NBINS) {
if (i >= SC_NBINS) {
return NULL;
}
return super_arenas_bin_i_node;
@ -3262,7 +3262,7 @@ CTL_RO_NL_GEN(arenas_lextent_i_size,
static const ctl_named_node_t *
arenas_lextent_i_index(
tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t i) {
if (i > SC_NSIZES - SC_NBINS) {
if (i >= SC_NSIZES - SC_NBINS) {
return NULL;
}
return super_arenas_lextent_i_node;