From: Richard Weinberger <richard@xxxxxx> req is of type size_t, casting it to long opens the door for an integer overflow. Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX cause and overflow such that request2size() returns MINSIZE. Fix by removing the cast. The origin of the cast is unclear, it's in u-boot and ppcboot since ever and predates the CVS history. Doug Lea's original dlmalloc implementation also doesn't have it. Signed-off-by: Richard Weinberger <richard@xxxxxx> Link: https://lore.barebox.org/barebox/2561107.TLnPLrj5Ze@somecomputer/ Link: https://lore.kernel.org/all/20240802100846.16619-2-richard@xxxxxx/ Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx> --- common/dlmalloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/common/dlmalloc.c b/common/dlmalloc.c index f92863f180d5..0ec7114c89d7 100644 --- a/common/dlmalloc.c +++ b/common/dlmalloc.c @@ -641,8 +641,8 @@ static inline mchunkptr mem2chunk(void *mem) /* pad request bytes into a usable size */ #define request2size(req) \ - (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ - (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ + ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \ + (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \ (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK))) /* Check if m has acceptable alignment */ -- 2.39.5
