dlmalloc: Fix integer overflow in sbrk()
Make sure that the new break is within mem_malloc_start
and mem_malloc_end before making progress.
ulong new = old + increment; can overflow for extremely large
increment values and memset() can get wrongly called.
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index 48e83da..8e201ac 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -581,6 +581,9 @@
ulong old = mem_malloc_brk;
ulong new = old + increment;
+ if ((new < mem_malloc_start) || (new > mem_malloc_end))
+ return (void *)MORECORE_FAILURE;
+
/*
* if we are giving memory back make sure we clear it out since
* we set MORECORE_CLEARS to 1
@@ -588,9 +591,6 @@
if (increment < 0)
memset((void *)new, 0, -increment);
- if ((new < mem_malloc_start) || (new > mem_malloc_end))
- return (void *)MORECORE_FAILURE;
-
mem_malloc_brk = new;
return (void *)old;