Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/lib/libc Add and use reallocarray() to prevent a multiplicat...
details: https://anonhg.NetBSD.org/src/rev/eb773047884b
branches: trunk
changeset: 335991:eb773047884b
user: christos <christos%NetBSD.org@localhost>
date: Thu Feb 05 16:04:35 2015 +0000
description:
Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!
diffstat:
lib/libc/regex/regcomp.c | 21 ++++++-----
lib/libc/stdlib/Makefile.inc | 5 +-
lib/libc/stdlib/malloc.3 | 77 ++++++++++++++++++++++++++++++++++++++---
lib/libc/stdlib/reallocarray.c | 41 ++++++++++++++++++++++
4 files changed, 125 insertions(+), 19 deletions(-)
diffs (295 lines):
diff -r 0eeafd7186a8 -r eb773047884b lib/libc/regex/regcomp.c
--- a/lib/libc/regex/regcomp.c Thu Feb 05 16:01:38 2015 +0000
+++ b/lib/libc/regex/regcomp.c Thu Feb 05 16:04:35 2015 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: regcomp.c,v 1.33 2012/03/13 21:13:43 christos Exp $ */
+/* $NetBSD: regcomp.c,v 1.34 2015/02/05 16:04:35 christos Exp $ */
/*-
* Copyright (c) 1992, 1993, 1994
@@ -76,11 +76,12 @@
#if 0
static char sccsid[] = "@(#)regcomp.c 8.5 (Berkeley) 3/20/94";
#else
-__RCSID("$NetBSD: regcomp.c,v 1.33 2012/03/13 21:13:43 christos Exp $");
+__RCSID("$NetBSD: regcomp.c,v 1.34 2015/02/05 16:04:35 christos Exp $");
#endif
#endif /* LIBC_SCCS and not lint */
#include "namespace.h"
+#include <sys/param.h>
#include <sys/types.h>
#include <assert.h>
@@ -262,12 +263,11 @@
len = strlen(pattern);
/* do the mallocs early so failure handling is easy */
- g = (struct re_guts *)malloc(sizeof(struct re_guts) +
- (NC-1)*sizeof(cat_t));
+ g = malloc(sizeof(struct re_guts) + (NC - 1) * sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
- p->strip = malloc(p->ssize * sizeof(sop));
+ p->strip = reallocarray(NULL, p->ssize, sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {
free(g);
@@ -1249,14 +1249,15 @@
if (MEMSIZE(p) > MEMLIMIT)
goto oomem;
if (p->g->sets == NULL)
- p->g->sets = malloc(nc * sizeof(cset));
+ p->g->sets = reallocarray(NULL, nc, sizeof(cset));
else
- p->g->sets = realloc(p->g->sets, nc * sizeof(cset));
+ p->g->sets = reallocarray(p->g->sets, nc, sizeof(cset));
if (p->g->setbits == NULL)
p->g->setbits = malloc(nbytes);
else {
p->g->setbits = realloc(p->g->setbits, nbytes);
- /* xxx this isn't right if setbits is now NULL */
+ if (p->g->setbits == NULL)
+ goto oomem;
for (i = 0; i < no; i++)
p->g->sets[i].ptr = p->g->setbits + css*(i/CHAR_BIT);
}
@@ -1779,7 +1780,7 @@
p->ssize = size;
if (MEMSIZE(p) > MEMLIMIT)
goto oomem;
- sp = realloc(p->strip, p->ssize * sizeof(sop));
+ sp = reallocarray(p->strip, p->ssize, sizeof(sop));
if (sp == NULL) {
oomem:
p->ssize = osize;
@@ -1804,7 +1805,7 @@
_DIAGASSERT(g != NULL);
g->nstates = p->slen;
- g->strip = realloc(p->strip, p->slen * sizeof(sop));
+ g->strip = reallocarray(p->strip, p->slen, sizeof(sop));
if (g->strip == NULL) {
SETERROR(REG_ESPACE);
g->strip = p->strip;
diff -r 0eeafd7186a8 -r eb773047884b lib/libc/stdlib/Makefile.inc
--- a/lib/libc/stdlib/Makefile.inc Thu Feb 05 16:01:38 2015 +0000
+++ b/lib/libc/stdlib/Makefile.inc Thu Feb 05 16:04:35 2015 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.inc,v 1.86 2015/01/18 17:59:36 christos Exp $
+# $NetBSD: Makefile.inc,v 1.87 2015/02/05 16:04:35 christos Exp $
# from: @(#)Makefile.inc 8.3 (Berkeley) 2/4/95
# stdlib sources
@@ -12,7 +12,7 @@
lcong48.c lrand48.c lsearch.c merge.c mi_vector_hash.c mrand48.c \
nrand48.c putenv.c qabs.c qdiv.c qsort.c posix_openpt.c pty.c \
quick_exit.c radixsort.c rand.c rand_r.c random.c remque.c \
- seed48.c setenv.c srand48.c strsuftoll.c \
+ reallocarray.c seed48.c setenv.c srand48.c strsuftoll.c \
strtoi.c strtou.c strtonum.c \
strtoimax.c strtol.c strtoll.c strtoq.c strtoul.c strtoull.c \
strtoumax.c strtouq.c system.c tdelete.c tfind.c tsearch.c twalk.c \
@@ -74,6 +74,7 @@
MLINKS+=insque.3 remque.3
MLINKS+=lsearch.3 lfind.3
MLINKS+=malloc.3 calloc.3 malloc.3 realloc.3 malloc.3 free.3
+MLINKS+=malloc.3 reallocarray.3
MLINKS+=qsort.3 heapsort.3 qsort.3 mergesort.3
MLINKS+=ptsname.3 ptsname_r.3
MLINKS+=rand.3 rand_r.3
diff -r 0eeafd7186a8 -r eb773047884b lib/libc/stdlib/malloc.3
--- a/lib/libc/stdlib/malloc.3 Thu Feb 05 16:01:38 2015 +0000
+++ b/lib/libc/stdlib/malloc.3 Thu Feb 05 16:04:35 2015 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: malloc.3,v 1.38 2010/05/03 08:23:20 jruoho Exp $
+.\" $NetBSD: malloc.3,v 1.39 2015/02/05 16:04:35 christos Exp $
.\"
.\" Copyright (c) 1980, 1991, 1993
.\" The Regents of the University of California. All rights reserved.
@@ -34,11 +34,11 @@
.\" @(#)malloc.3 8.1 (Berkeley) 6/4/93
.\" $FreeBSD: src/lib/libc/stdlib/malloc.3,v 1.73 2007/06/15 22:32:33 jasone Exp $
.\"
-.Dd May 3, 2010
+.Dd February 5, 2015
.Dt MALLOC 3
.Os
.Sh NAME
-.Nm malloc , calloc , realloc , free
+.Nm malloc , calloc , realloc , reallocarray, free
.Nd general purpose memory allocation functions
.Sh LIBRARY
.Lb libc
@@ -50,6 +50,8 @@
.Fn calloc "size_t number" "size_t size"
.Ft void *
.Fn realloc "void *ptr" "size_t size"
+.Ft void *
+.Fn reallocarray "void *ptr" "size_t number" "size_t size"
.Ft void
.Fn free "void *ptr"
.Sh DESCRIPTION
@@ -74,7 +76,7 @@
with an argument of
.Dq "number * size" ,
with the exception that the allocated memory is explicitly initialized
-to zero bytes.
+to zero bytes, and overflow is being checked.
.Pp
The
.Fn realloc
@@ -90,8 +92,22 @@
Upon success, the memory referenced by
.Fa ptr
is freed and a pointer to the newly allocated memory is returned.
+.Pp
+The
+.Fn reallocarray
+function is similar to
+.Fn realloc
+except it operates on
+.Fa number
+members of size
+.Fa size
+and checks for integer overflow in the calculation of\
+.Dq "number * size" .
+.Pp
Note that
.Fn realloc
+and
+.Fn reallocarray
may move the memory allocation, resulting in a different return value than
.Fa ptr .
If
@@ -129,7 +145,9 @@
.Pp
The
.Fn realloc
-function returns a pointer, possibly identical to
+and
+.Fn reallocarray
+functions return a pointer, possibly identical to
.Fa ptr ,
to the allocated memory
if successful; otherwise a
@@ -141,7 +159,9 @@
if the error was the result of an allocation failure.
The
.Fn realloc
-function always leaves the original buffer intact
+and
+.Fn reallocarray
+functions always leave the original buffer intact
when an error occurs.
.Pp
The
@@ -158,7 +178,7 @@
.Pp
The multiplication may lead to an integer overflow.
To avoid this,
-.Fn calloc
+.Fn reallocarray
is recommended.
.Pp
If
@@ -171,6 +191,42 @@
}
.Ed
.Pp
+The above test is not sufficient in all cases.
+For example, multiplying ints requires a different set of checks:
+.Bd -literal -offset indent
+int num, size;
+\&.\&.\&.
+
+/* Avoid invalid requests */
+if (size < 0 || num < 0)
+ errc(1, EOVERFLOW, "overflow");
+
+/* Check for signed int overflow */
+if (size && num > INT_MAX / size)
+ errc(1, EOVERFLOW, "overflow");
+
+if ((p = malloc(size * num)) == NULL)
+ err(1, "malloc");
+.Ed
+.Pp
+Assuming the implementation checks for integer overflow as
+.Nx
+does, it is much easier to use
+.Fn calloc
+or
+.Fn reallocarray .
+.Pp
+The above examples could be simplified to:
+.Bd -literal -offset indent
+if ((p = reallocarray(NULL, num, size)) == NULL)
+ err(1, "reallocarray");
+.Ed
+.Bd -literal -offset indent
+or at the cost of initialization:
+if ((p = calloc(num, size)) == NULL)
+ err(1, "calloc");
+.Ed
+.Pp
When using
.Fn realloc ,
one must be careful to avoid the following idiom:
@@ -227,3 +283,10 @@
.Fn free
functions conform to
.St -isoC .
+.Pp
+The
+.Fn reallocarray
+function first appeared on
+.Ox 5.6
+and
+.Nx 8 .
diff -r 0eeafd7186a8 -r eb773047884b lib/libc/stdlib/reallocarray.c
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/lib/libc/stdlib/reallocarray.c Thu Feb 05 16:04:35 2015 +0000
@@ -0,0 +1,41 @@
+/* $OpenBSD: reallocarray.c,v 1.1 2014/05/08 21:43:49 deraadt Exp $ */
+/*
+ * Copyright (c) 2008 Otto Moerbeek <otto%drijf.net@localhost>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <sys/cdefs.h>
+__RCSID("$NetBSD: reallocarray.c,v 1.1 2015/02/05 16:04:35 christos Exp $");
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <errno.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/*
+ * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX
+ * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW
+ */
+#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * (CHAR_BIT / 2)))
+
+void *
+reallocarray(void *optr, size_t nmemb, size_t size)
+{
+ if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
+ size > 0 && nmemb > 0 && SIZE_MAX / nmemb < size) {
+ errno = ENOMEM;
+ return NULL;
+ }
+ return realloc(optr, size * nmemb);
+}
Home |
Main Index |
Thread Index |
Old Index