mm/mm_heap/mm_realloc : Add logic for checking overflow of size
MM_ALIGN_UP do an unsafe calculation that can cause integer wrap-around.
For avoiding integer wrap-around, check the size whether it is smaller than possible allocation size.
@@ -136,6 +136,13 @@ FAR void *mm_realloc(FAR struct mm_heap_s *heap, FAR void *oldmem, size_t size)
return NULL;
}
+ if (size > MM_ALIGN_DOWN(MMSIZE_MAX) - SIZEOF_MM_ALLOCNODE) {
+ mdbg("Because of mm_allocnode, %u cannot be allocated. The maximum \
+ allocable size is (MM_ALIGN_DOWN(MMSIZE_MAX) - SIZEOF_MM_ALLOCNODE) \
+ : %u\n.", size, (MM_ALIGN_DOWN(MMSIZE_MAX) - SIZEOF_MM_ALLOCNODE));
+ return NULL;
+ }
+
/* Adjust the size to account for (1) the size of the allocated node and
* (2) to make sure that it is an even multiple of our granule size.
*/
