Merge pull request #14408 from LDong-Arm/malloc_wrapper_fix-5.15

Add integer overflow check to the malloc wrappers
ARMmbed · Mar 22, 2021 · 52eedfd · 52eedfd
2 parents 878a32c + 151ebfc
commit 52eedfd
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/platform/source/mbed_alloc_wrappers.cpp b/platform/source/mbed_alloc_wrappers.cpp
@@ -105,7 +105,10 @@ extern "C" void *malloc_wrapper(struct _reent *r, size_t size, void *caller)
 #endif
 #ifdef MBED_HEAP_STATS_ENABLED
     malloc_stats_mutex->lock();
-    alloc_info_t *alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
+    alloc_info_t *alloc_info = NULL;
+    if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
+        alloc_info = (alloc_info_t *)__real__malloc_r(r, size + sizeof(alloc_info_t));
+    }
     if (alloc_info != NULL) {
         alloc_info->size = size;
         alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;
@@ -292,7 +295,10 @@ extern "C" void *malloc_wrapper(size_t size, void *caller)
 #endif
 #ifdef MBED_HEAP_STATS_ENABLED
     malloc_stats_mutex->lock();
-    alloc_info_t *alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
+    alloc_info_t *alloc_info = NULL;
+    if (size <= SIZE_MAX - sizeof(alloc_info_t)) {
+        alloc_info = (alloc_info_t *)SUPER_MALLOC(size + sizeof(alloc_info_t));
+    }
     if (alloc_info != NULL) {
         alloc_info->size = size;
         alloc_info->signature = MBED_HEAP_STATS_SIGNATURE;