getservbyport_r: fix out-of-bounds buffer read

[musl] / src / malloc / lite_malloc.c

diff --git a/src/malloc/lite_malloc.c b/src/malloc/lite_malloc.c
index 7643fc2..43a988f 100644 (file)
--- a/src/malloc/lite_malloc.c
+++ b/src/malloc/lite_malloc.c
@@ -2,45 +2,117 @@
 #include <stdint.h>
 #include <limits.h>
 #include <errno.h>
+#include <sys/mman.h>
 #include "libc.h"
-
-uintptr_t __brk(uintptr_t);
+#include "lock.h"
+#include "syscall.h"
+#include "fork_impl.h"
 
 #define ALIGN 16
 
-void *__simple_malloc(size_t n)
+/* This function returns true if the interval [old,new]
+ * intersects the 'len'-sized interval below &libc.auxv
+ * (interpreted as the main-thread stack) or below &b
+ * (the current stack). It is used to defend against
+ * buggy brk implementations that can cross the stack. */
+
+static int traverses_stack_p(uintptr_t old, uintptr_t new)
 {
-       static uintptr_t cur, brk;
-       uintptr_t base, new;
-       static volatile int lock[2];
+       const uintptr_t len = 8<<20;
+       uintptr_t a, b;
+
+       b = (uintptr_t)libc.auxv;
+       a = b > len ? b-len : 0;
+       if (new>a && old<b) return 1;
+
+       b = (uintptr_t)&b;
+       a = b > len ? b-len : 0;
+       if (new>a && old<b) return 1;
+
+       return 0;
+}
+
+static volatile int lock[1];
+volatile int *const __bump_lockptr = lock;
+
+static void *__simple_malloc(size_t n)
+{
+       static uintptr_t brk, cur, end;
+       static unsigned mmap_step;
        size_t align=1;
+       void *p;
 
-       if (!n) n++;
-       if (n > SIZE_MAX/2) goto toobig;
+       if (n > SIZE_MAX/2) {
+               errno = ENOMEM;
+               return 0;
+       }
 
+       if (!n) n++;
        while (align<n && align<ALIGN)
                align += align;
-       n = n + align - 1 & -align;
 
        LOCK(lock);
-       if (!cur) cur = brk = __brk(0)+16;
-       base = cur + align-1 & -align;
-       if (n > SIZE_MAX - PAGE_SIZE - base) goto fail;
-       if (base+n > brk) {
-               new = base+n + PAGE_SIZE-1 & -PAGE_SIZE;
-               if (__brk(new) != new) goto fail;
-               brk = new;
+
+       cur += -cur & align-1;
+
+       if (n > end-cur) {
+               size_t req = n - (end-cur) + PAGE_SIZE-1 & -PAGE_SIZE;
+
+               if (!cur) {
+                       brk = __syscall(SYS_brk, 0);
+                       brk += -brk & PAGE_SIZE-1;
+                       cur = end = brk;
+               }
+
+               if (brk == end && req < SIZE_MAX-brk
+                   && !traverses_stack_p(brk, brk+req)
+                   && __syscall(SYS_brk, brk+req)==brk+req) {
+                       brk = end += req;
+               } else {
+                       int new_area = 0;
+                       req = n + PAGE_SIZE-1 & -PAGE_SIZE;
+                       /* Only make a new area rather than individual mmap
+                        * if wasted space would be over 1/8 of the map. */
+                       if (req-n > req/8) {
+                               /* Geometric area size growth up to 64 pages,
+                                * bounding waste by 1/8 of the area. */
+                               size_t min = PAGE_SIZE<<(mmap_step/2);
+                               if (min-n > end-cur) {
+                                       if (req < min) {
+                                               req = min;
+                                               if (mmap_step < 12)
+                                                       mmap_step++;
+                                       }
+                                       new_area = 1;
+                               }
+                       }
+                       void *mem = __mmap(0, req, PROT_READ|PROT_WRITE,
+                               MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+                       if (mem == MAP_FAILED || !new_area) {
+                               UNLOCK(lock);
+                               return mem==MAP_FAILED ? 0 : mem;
+                       }
+                       cur = (uintptr_t)mem;
+                       end = cur + req;
+               }
        }
-       cur = base+n;
+
+       p = (void *)cur;
+       cur += n;
        UNLOCK(lock);
+       return p;
+}
 
-       return (void *)base;
+weak_alias(__simple_malloc, __libc_malloc_impl);
 
-fail:
-       UNLOCK(lock);
-toobig:
-       errno = ENOMEM;
-       return 0;
+void *__libc_malloc(size_t n)
+{
+       return __libc_malloc_impl(n);
+}
+
+static void *default_malloc(size_t n)
+{
+       return __libc_malloc_impl(n);
 }
 
-weak_alias(__simple_malloc, malloc);
+weak_alias(default_malloc, malloc);