[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#852018: zapping: Segfaults immediately



Hello Helge,
net being the zapping maintainer, I just tried to have a look at it.

It looks like alloc_aligned does truncate the pointer to 32 bits.

Therefore storing the original pointer, for being able to free it later,
fails.

common/alloc.c:
37              p = (void *)(((long)((char *) b + align)) & -align);

1: b = (void *) 0x555555c04a20
2: p = (void *) 0x55c04a40

Attached patch should fix the issue.
Even better would probably be build with HAVE_MEMALIGN defined.

Kind regards,
Bernhard
From 1ab9edb2b93ee6b8c01f439309d3417a8e8c1344 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?= <bernhardu@mailbox.org>
Date: Thu, 26 Jan 2017 17:16:23 +0100
Subject: Fix alloc_aligned on 64bit.

Even better would probably be to define HAVE_MEMALIGN.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=852018
---
 common/alloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/common/alloc.c b/common/alloc.c
index 8649c43..ac53663 100644
--- a/common/alloc.c
+++ b/common/alloc.c
@@ -34,7 +34,7 @@ alloc_aligned(size_t size, unsigned int align, z_bool clear)
 	if (!(b = malloc(size + align)))
 		return NULL;
 
-	p = (void *)(((long)((char *) b + align)) & -align);
+	p = (void *)(((size_t)((char *) b + ((size_t)align))) & -((size_t)align));
 
 	((void **) p)[-1] = b;
 
-- 
2.11.0


Reply to: