From 3b1dca8167d8abc22a7e0c71759bfc560c4e71c5 Mon Sep 17 00:00:00 2001 From: Brennan Ashton Date: Sun, 28 Jun 2020 11:57:38 -0700 Subject: [PATCH] mm: Do not memcopy more than oldsize when realloc When realloc up from a mem area to a larger one where a new node is needed. The the larger memory region is copied from the source this can both leak data as well as cause memory faults accesssing invalid data. This was first reported by Kwonsk Signed-off-by: Brennan Ashton --- mm/mm_heap/mm_realloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/mm/mm_heap/mm_realloc.c b/mm/mm_heap/mm_realloc.c index 8b983b05682..1f83ee76b28 100644 --- a/mm/mm_heap/mm_realloc.c +++ b/mm/mm_heap/mm_realloc.c @@ -270,17 +270,17 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem, (next->preceding & MM_ALLOC_BIT); } - /* Now we want to return newnode */ - - oldnode = newnode; - oldsize = newnode->size; - /* Now we have to move the user contents 'down' in memory. memcpy * should be safe for this. */ newmem = (FAR void *)((FAR char *)newnode + SIZEOF_MM_ALLOCNODE); memcpy(newmem, oldmem, oldsize - SIZEOF_MM_ALLOCNODE); + + /* Now we want to return newnode */ + + oldnode = newnode; + oldsize = newnode->size; } /* Extend into the next free chunk */