svn commit: r262277 - head/libexec/rtld-elf

[David Xu]

Author: davidxu
Date: Fri Feb 21 03:36:16 2014
New Revision: 262277
URL: http://svnweb.freebsd.org/changeset/base/262277

Log:
  malloc_aligned() may not leave enough space for pointer to allocated memory,
  saving the pointer will overwrite bytes belongs to another memory block
  unexpectly, to fix the problem, use (allocated address + sizeof(void *)) as
  initial value, and slip to next aligned address, so maximum extra bytes is
  sizeof(void *) + align - 1.
  
  Tested by: Andre Albsmeier < mail at ma17 dot ata dot myota dot orgndre >

Modified:
  head/libexec/rtld-elf/xmalloc.c

Modified: head/libexec/rtld-elf/xmalloc.c
==============================================================================
--- head/libexec/rtld-elf/xmalloc.c	Fri Feb 21 03:35:43 2014	(r262276)
+++ head/libexec/rtld-elf/xmalloc.c	Fri Feb 21 03:36:16 2014	(r262277)
@@ -72,14 +72,14 @@ void *
 malloc_aligned(size_t size, size_t align)
 {
 	void *mem, *res;
-	uintptr_t x;
-	size_t asize, r;
 
-	r = round(sizeof(void *), align);
-	asize = round(size, align) + r;
-	mem = xmalloc(asize);
-	x = (uintptr_t)mem;
-	res = (void *)round(x, align);
+	if (align & (sizeof(void *) -1)) {
+		rtld_fdputstr(STDERR_FILENO, "Invalid alignment\n");
+		_exit(1);
+	}
+
+	mem = xmalloc(size + sizeof(void *) + align - 1);
+	res = (void *)round((uintptr_t)mem + sizeof(void *), align);
 	*(void **)((uintptr_t)res - sizeof(void *)) = mem;
 	return (res);
 }