[OpenBIOS] [PATCH 2/7] OFMEM: Fix selection of reusable memory areas from the internal malloc() freelist.

[Mark Cave-Ayland]

The existing code would incorrectly allow freelist memory to be reused if the
requested size were 0x1000 greater than the freelist item size, rather than the
freelist item size being 0x1000 greater than the requested size.

Since internal memory allocations could be smaller than requested, it would be
possible for a caller to clobber over the internal memory heap causing a crash or
internal memory corruption.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
---
 openbios-devel/libopenbios/ofmem_common.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openbios-devel/libopenbios/ofmem_common.c b/openbios-devel/libopenbios/ofmem_common.c
index bae0732..4c464c8 100644
--- a/openbios-devel/libopenbios/ofmem_common.c
+++ b/openbios-devel/libopenbios/ofmem_common.c
@@ -107,7 +107,7 @@ int ofmem_posix_memalign( void **memptr, size_t alignment, size_t size )
 	}
 
 	/* waste at most 4K by taking an entry from the freelist */
-	if( *pp && (**pp).size < size + 0x1000 ) {
+	if( *pp && (**pp).size > size + 0x1000 ) {
 		/* Alignment should be on physical not virtual address */
 		pa = va2pa((uintptr_t)*pp + sizeof(alloc_desc_t));
 		pa = align_ptr(pa, alignment);
-- 
1.7.10.4