Skip to content

Fix/allocator size overflow - #556

Open
Sn0wyDay wants to merge 2 commits into
bellard:masterfrom
Sn0wyDay:fix/allocator-size-overflow
Open

Sn0wyDay wants to merge 2 commits into
bellard:masterfrom
Sn0wyDay:fix/allocator-size-overflow

Conversation

@Sn0wyDay

@Sn0wyDay Sn0wyDay commented Sep 1, 2026

Copy link
Copy Markdown

Problem

The allocator aligns each requested size and adds an internal block header. For values near SIZE_MAX, these calculations can wrap and make an oversized request appear to be a small allocation.

As a result, js_malloc_rt() can return an undersized block for an unrepresentable request. The same issue affects allocation and reallocation paths, while the default allocator's memory-limit checks also contain arithmetic that can wrap before comparison.

Fix

  • Reject sizes that cannot accommodate alignment and the largest internal block header.
  • Apply the validation to allocation and reallocation paths.
  • Rewrite the default allocator's limit checks using checked subtraction.
  • Add regression coverage for SIZE_MAX allocation, zeroed allocation, and reallocation requests.

A failed reallocation continues to preserve the original allocation and its contents.

Testing

  • make -j8 test
  • make CONFIG_ASAN=y CONFIG_UBSAN=y -j8 test
  • LTO and warning-as-error builds

Reject requests whose alignment and allocator headers would overflow size_t.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant