Integer overflow in allocation

[insuyun]

Hi, Brian.

While doing research on allocators,
we have found that ffmalloc has an integer overflow in its allocation.

For example, this code expects to return NULL,
but in ffmalloc, due to the integer overflow in this code, it returns a valid address.

int main() {
  char* p = malloc(-8);
  printf("%p\n", p);
}

$  LD_PRELOAD=$(pwd)/ffmalloc/libffmallocnpst.so ./poc
0x55b08152c000

I think you need to have additional check before aligning the size.

Best,
Insu Yun.

[bwickman97]

Thanks Insu. I've added checks to malloc plus the various "aligned" functions.