The existing code would incorrectly allow freelist memory to be reused if the requested size were 0x1000 greater than the freelist item size, rather than the freelist item size being 0x1000 greater than the requested size.
Since internal memory allocations could be smaller than requested, it would be possible for a caller to clobber over the internal memory heap causing a crash or internal memory corruption.
Signed-off-by: Mark Cave-Ayland mark.cave-ayland@ilande.co.uk --- openbios-devel/libopenbios/ofmem_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/openbios-devel/libopenbios/ofmem_common.c b/openbios-devel/libopenbios/ofmem_common.c index bae0732..4c464c8 100644 --- a/openbios-devel/libopenbios/ofmem_common.c +++ b/openbios-devel/libopenbios/ofmem_common.c @@ -107,7 +107,7 @@ int ofmem_posix_memalign( void **memptr, size_t alignment, size_t size ) }
/* waste at most 4K by taking an entry from the freelist */ - if( *pp && (**pp).size < size + 0x1000 ) { + if( *pp && (**pp).size > size + 0x1000 ) { /* Alignment should be on physical not virtual address */ pa = va2pa((uintptr_t)*pp + sizeof(alloc_desc_t)); pa = align_ptr(pa, alignment);