Skip to content

Commit 52eedfd

Browse files
authored
Merge pull request #14408 from LDong-Arm/malloc_wrapper_fix-5.15
Add integer overflow check to the malloc wrappers
2 parents 878a32c + 151ebfc commit 52eedfd

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

platform/source/mbed_alloc_wrappers.cpp

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,10 @@ extern "C" void *malloc_wrapper(struct _reent *r, size_t size, void *caller)
105105
#endif
106106
#ifdef MBED_HEAP_STATS_ENABLED
107107
malloc_stats_mutex->lock();
108-
alloc_info_t *alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
108+
alloc_info_t *alloc_info = NULL;
109+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
110+
alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
111+
}
109112
if (alloc_info != NULL) {
110113
alloc_info->size = size;
111114
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;
@@ -292,7 +295,10 @@ extern "C" void *malloc_wrapper(size_t size, void *caller)
292295
#endif
293296
#ifdef MBED_HEAP_STATS_ENABLED
294297
malloc_stats_mutex->lock();
295-
alloc_info_t *alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
298+
alloc_info_t *alloc_info = NULL;
299+
if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
300+
alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
301+
}
296302
if (alloc_info != NULL) {
297303
alloc_info->size = size;
298304
alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;

0 commit comments

Comments
 (0)