From 72601dd6839b89e0bcd367d790b590a6f1692ed8 Mon Sep 17 00:00:00 2001 From: Vitor Menezes Date: Thu, 11 May 2017 00:04:48 -0700 Subject: [PATCH] Protect against large sizes resulting in off-the-end free blocks --- tlsf.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/tlsf.c b/tlsf.c index a3bc37f..6bcfe2b 100644 --- a/tlsf.c +++ b/tlsf.c @@ -753,7 +753,17 @@ static block_header_t* block_locate_free(control_t* control, size_t size) if (size) { mapping_search(size, &fl, &sl); - block = search_suitable_block(control, &fl, &sl); + + /* + ** mapping_search can futz with the size, so for excessively large sizes it can sometimes wind up + ** with indices that are off the end of the block array. + ** So, we protect against that here, since this is the only callsite of mapping_search. + ** Note that we don't need to check sl, since it comes from a modulo operation that guarantees it's always in range. + */ + if (fl < FL_INDEX_COUNT) + { + block = search_suitable_block(control, &fl, &sl); + } } if (block)