| author |  Jonathan Marler <johnnymarler@gmail.com> 2020-06-28 14:33:41-06:00 |
| committer |  Andrew Kelley <andrew@ziglang.org> 2020-06-28 18:05:18-04:00 |
| log | c2eead9629b60a394aa61e6f96b89647eddce1ea |
| tree | a14ec292715a2ceb0cd9b8d018eee58449230256 |
| parent | 374e3e42e0de10d21406c077599cfc4a6a813497 |
Fix issue 5741, use after free
2 files changed, 5 insertions(+), 3 deletions(-)
lib/std/heap.zig+5
| ... | @@ -714,6 +714,11 @@ test "PageAllocator" { | ... | @@ -714,6 +714,11 @@ test "PageAllocator" { |
| 714 | slice[127] = 0x34; | 714 | slice[127] = 0x34; |
| 715 | allocator.free(slice); | 715 | allocator.free(slice); |
| 716 | } | 716 | } |
| 717 | { | ||
| 718 | var buf = try allocator.alloc(u8, mem.page_size + 1); | ||
| 719 | defer allocator.free(buf); | ||
| 720 | buf = try allocator.realloc(buf, 1); // shrink past the page boundary | ||
| 721 | } | ||
| 717 | } | 722 | } |
| 718 | 723 | ||
| 719 | test "HeapAllocator" { | 724 | test "HeapAllocator" { |
lib/std/mem.zig-3
| ... | @@ -116,9 +116,6 @@ pub const Allocator = struct { | ... | @@ -116,9 +116,6 @@ pub const Allocator = struct { |
| 116 | if (isAligned(@ptrToInt(old_mem.ptr), new_alignment)) { | 116 | if (isAligned(@ptrToInt(old_mem.ptr), new_alignment)) { |
| 117 | if (new_byte_count <= old_mem.len) { | 117 | if (new_byte_count <= old_mem.len) { |
| 118 | const shrunk_len = self.shrinkBytes(old_mem, new_byte_count, len_align); | 118 | const shrunk_len = self.shrinkBytes(old_mem, new_byte_count, len_align); |
| 119 | if (shrunk_len < old_mem.len) { | ||
| 120 | @memset(old_mem.ptr + shrunk_len, undefined, old_mem.len - shrunk_len); | ||
| 121 | } | ||
| 122 | return old_mem.ptr[0..shrunk_len]; | 119 | return old_mem.ptr[0..shrunk_len]; |
| 123 | } | 120 | } |
| 124 | if (self.callResizeFn(old_mem, new_byte_count, len_align)) |resized_len| { | 121 | if (self.callResizeFn(old_mem, new_byte_count, len_align)) |resized_len| { |