commit 25c5843ad5762d0ccaab03f3c516035cd48d21d1
author Richard Weinberger <richard@nod.at> Fri Aug 02 12:08:46 2024 +0200
committer Tom Rini <trini@konsulko.com> Thu Aug 15 16:14:36 2024 -0600
tree 359bc26f3807ac4b26a3f74682754c8e3bd44246
parent b6c32c59749812d035c2b96815a3c653724d22c4

dlmalloc: Make sure allocation size is within malloc area

Since U-Boot does not support memory overcommit we can
enforce that the allocation size is within the malloc area.
This is a simple and efficient hardening measure to mitigate
further integer overflows in dlmalloc.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>

common/dlmalloc.c

diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index 8e201ac..1ac7ce3 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -1274,7 +1274,8 @@
     return NULL;
   }
 
-  if ((long)bytes < 0) return NULL;
+  if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
+     return NULL;
 
   nb = request2size(bytes);  /* padded request size; */
 
@@ -1687,7 +1688,8 @@
   }
 #endif
 
-  if ((long)bytes < 0) return NULL;
+  if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
+     return NULL;
 
   /* realloc of null is supposed to be same as malloc */
   if (oldmem == NULL) return mALLOc_impl(bytes);
@@ -1911,7 +1913,8 @@
   mchunkptr remainder;        /* spare room at end to split off */
   long      remainder_size;   /* its size */
 
-  if ((long)bytes < 0) return NULL;
+  if (bytes > CONFIG_SYS_MALLOC_LEN || (long)bytes < 0)
+     return NULL;
 
 #if CONFIG_IS_ENABLED(SYS_MALLOC_F)
 	if (!(gd->flags & GD_FLG_FULL_MALLOC_INIT)) {