Skip to content

fix(wrap-mupdf): prevent integer overflow in allocator#2472

Open
tachibana-shin wants to merge 1 commit into
koreader:masterfrom
tachibana-shin:fix/wrap-mupdf-overflow
Open

fix(wrap-mupdf): prevent integer overflow in allocator#2472
tachibana-shin wants to merge 1 commit into
koreader:masterfrom
tachibana-shin:fix/wrap-mupdf-overflow

Conversation

@tachibana-shin

@tachibana-shin tachibana-shin commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

my_malloc_default computes size + sizeof(header) to allocate extra space
for its tracking header. If size is close to SIZE_MAX, the addition wraps
to a small value. malloc succeeds with a tiny allocation, but the caller
operates as if it received size bytes — heap buffer overflow


This change is Reviewable

my_malloc_default: check 'size > SIZE_MAX - sizeof(header)' before
computing 'size + sizeof(header)'. If size is close to SIZE_MAX, the
addition wraps to a small value, causing malloc to allocate a tiny
buffer while the caller expects a large one — heap buffer overflow.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants