espressif/tlsf
1
0
Fork 0
mirror of https://github.com/espressif/tlsf.git synced 2026-08-21 09:20:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Protect against large sizes resulting in off-the-end free blocks

Browse Source
This commit is contained in:
Vitor Menezes
2017-05-11 00:04:48 -07:00
parent 7d6c9a78da
commit 72601dd683
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tlsf.c
+11 -1
View File
@@ -753,7 +753,17 @@ static block_header_t* block_locate_free(control_t* control, size_t size)
if (size)
{
mapping_search(size, &fl, &sl);
block = search_suitable_block(control, &fl, &sl);
/*
** mapping_search can futz with the size, so for excessively large sizes it can sometimes wind up
** with indices that are off the end of the block array.
** So, we protect against that here, since this is the only callsite of mapping_search.
** Note that we don't need to check sl, since it comes from a modulo operation that guarantees it's always in range.
*/
if (fl < FL_INDEX_COUNT)
{
block = search_suitable_block(control, &fl, &sl);
}
}
if (block)