[PATCH] libc/stdlib/malloc/realloc.c: Fix failure when doing realloc(mem, -1).

[Mike Frysinger]

On Thursday 30 July 2009 15:58:31 James Coleman wrote:
> Now check that new_size is > ((unsigned long)-(MALLOC_HEADER_SIZE*2)),
> which is the same test that is found in malloc.
> 
> This fixes a test failure in test/malloc/tst-mcheck.
> 
> -  /* Check for special cases.  */
> -  if (! new_size)
> +  /* Check for special cases, such as realloc(mem, 0) or if they are
> +     doing something dumb like realloc(mem, -1) */
> +  if (unlikely(! new_size) ||
> +      unlikely(((unsigned long)new_size > (unsigned
>  long)(MALLOC_HEADER_SIZE*-2)))) {
>        free (mem);
>        return malloc (new_size);

if we do overflow the size field, i dont think we should bother calling down 
to malloc().  it's going to come to the same conclusion and return NULL.  so i 
updated the realloc() code to return NULL itself if this case.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.busybox.net/pipermail/uclibc/attachments/20091015/3ed74c35/attachment.pgp>