Skip to content

Commit cf6853d

Browse files
Add checks for overflow in memory allocator
1 parent 0b522b4 commit cf6853d

1 file changed

Lines changed: 18 additions & 2 deletions

File tree

src/mem.c

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,16 @@ void mem_reset(void) {
4343
* @return Allocated memory pointer; \ref NULL if not enough space left.
4444
*/
4545
void *mem_alloc(size_t size) {
46+
size_t new_idx;
47+
size_t free_size;
48+
49+
if (__builtin_add_overflow((size_t)mem_idx, size, &new_idx) ||
50+
__builtin_sub_overflow(sizeof(mem_buffer), (size_t)mem_rev_idx, &free_size)) {
51+
PRINTF("Error: overflow detected!\n");
52+
return NULL;
53+
}
4654
// Buffer exceeded
47-
if ((mem_idx + size) > (sizeof(mem_buffer) - mem_rev_idx)) {
55+
if (new_idx > free_size) {
4856
PRINTF("Error: mem_alloc(%u) failed!\n", size);
4957
return NULL;
5058
}
@@ -74,8 +82,16 @@ void mem_dealloc(size_t size) {
7482
* @return Allocated memory pointer; \ref NULL if not enough space left.
7583
*/
7684
void *mem_rev_alloc(size_t size) {
85+
size_t free_size;
86+
size_t new_rev_idx;
87+
88+
if (__builtin_add_overflow((size_t)mem_rev_idx, size, &new_rev_idx) ||
89+
__builtin_sub_overflow(sizeof(mem_buffer), new_rev_idx, &free_size)) {
90+
PRINTF("Error: overflow detected!\n");
91+
return NULL;
92+
}
7793
// Buffer exceeded
78-
if ((sizeof(mem_buffer) - (mem_rev_idx + size)) < mem_idx) {
94+
if (free_size < mem_idx) {
7995
PRINTF("Error: mem_rev_alloc(%u) failed!\n", size);
8096
return NULL;
8197
}

0 commit comments

Comments
 (0)