kiper220/mimalloc
1
0
Fork 0
mirror of https://github.com/microsoft/mimalloc.git synced 2025-05-07 15:59:32 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix out-of-bounds write on span free in huge segments

Browse source
This commit is contained in:
Daan 2024-05-16 14:26:05 -07:00
parent 44b65b19df
commit 4a26a4568e
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/segment.c
View file

@ -623,7 +623,9 @@ static void mi_segment_span_free(mi_segment_t* segment, size_t slice_index, size
mi_assert_internal(slice->slice_count == slice_count); // no overflow? mi_assert_internal(slice->slice_count == slice_count); // no overflow?
slice->slice_offset = 0; slice->slice_offset = 0;
if (slice_count > 1) { if (slice_count > 1) {
mi_slice_t* last = &segment->slices[slice_index + slice_count - 1]; mi_slice_t* last = slice + slice_count - 1;
mi_slice_t* end = (mi_slice_t*)mi_segment_slices_end(segment);
if (last > end) { last = end; }
last->slice_count = 0; last->slice_count = 0;
last->slice_offset = (uint32_t)(sizeof(mi_page_t)*(slice_count - 1)); last->slice_offset = (uint32_t)(sizeof(mi_page_t)*(slice_count - 1));
last->block_size = 0; last->block_size = 0;