diff options
| author | Jonathan Wakely <jwakely@redhat.com> | 2020-05-04 21:13:28 +0100 |
|---|---|---|
| committer | Jonathan Wakely <jwakely@redhat.com> | 2020-05-04 22:47:30 +0100 |
| commit | bb27781b64162e1769df15e0c97e8d2145d2d10d (patch) | |
| tree | 2c34c125e8275c26ac0ab02ca7b42ab2ad7bbd35 /libstdc++-v3 | |
| parent | cc7e4de998cd2a31eb7c834fd427e7f16a99d60a (diff) | |
libstdc++: Fix incorrect size calculation in PMR resource (PR 94906)
Calculating the size of a chunk being returned to the upstream allocator
was done with a 32-bit type, so it wrapped if the chunk was 4GB or
larger.
I don't know how to test this without allocating 4GB, so there's no test
in the testsuite. It has been tested manually with allocations sizes and
alignments exceeding 4GB.
PR libstdc++/94906
* src/c++17/memory_resource.cc
(monotonic_buffer_resource::_Chunk::release): Use size_t for shift
operands.
Diffstat (limited to 'libstdc++-v3')
| -rw-r--r-- | libstdc++-v3/ChangeLog | 7 | ||||
| -rw-r--r-- | libstdc++-v3/src/c++17/memory_resource.cc | 4 |
2 files changed, 9 insertions, 2 deletions
diff --git a/libstdc++-v3/ChangeLog b/libstdc++-v3/ChangeLog index 739ab9eeb29..9cc811c884f 100644 --- a/libstdc++-v3/ChangeLog +++ b/libstdc++-v3/ChangeLog @@ -1,3 +1,10 @@ +2020-05-04 Jonathan Wakely <jwakely@redhat.com> + + PR libstdc++/94906 + * src/c++17/memory_resource.cc + (monotonic_buffer_resource::_Chunk::release): Use size_t for shift + operands. + 2020-05-04 Nathan Sidwell <nathan@acm.org> PR libstdc++/94747 diff --git a/libstdc++-v3/src/c++17/memory_resource.cc b/libstdc++-v3/src/c++17/memory_resource.cc index 1acab19e306..95352b23537 100644 --- a/libstdc++-v3/src/c++17/memory_resource.cc +++ b/libstdc++-v3/src/c++17/memory_resource.cc @@ -228,8 +228,8 @@ namespace pmr if (__ch->_M_canary != (__ch->_M_size | __ch->_M_align)) return; // buffer overflow detected! - size_t __size = (1u << __ch->_M_size); - size_t __align = (1u << __ch->_M_align); + size_t __size = (size_t)1 << __ch->_M_size; + size_t __align = (size_t)1 << __ch->_M_align; void* __start = (char*)(__ch + 1) - __size; __r->deallocate(__start, __size, __align); } |