Integer overflow in allocation size

[insuyun]

Hi. I am testing a secure allocator and found integer overflow.
Here is PoC code.

#include <stdio.h>
#include <stdlib.h>

int main() {
  fprintf(stderr, "%p\n", malloc(-8));
}

$ LD_PRELOAD=$(pwd)/libisoalloc.so ./poc
0x7febb1fa3000

It seems because you don't have integer overflow check in ROUND_UP_PAGE(size).

isoalloc/src/iso_alloc.c

Line 674 in d433f3c

size = ROUND_UP_PAGE(size);

Best,
Insu Yun.

[struct]

Thanks @insuyun. This is indeed a bug, but I think it only affects the big zone allocation path. I will have a fix for it in the next code push probably in a few days. Thanks for filing this issue!