Skip to content
Unverified Commit 97c5be7b authored by Michael Müller's avatar Michael Müller
Browse files

Fix bug in allocator

Under certain circumstances an invalid pointer was
returned: when the `ptr` was calculated as equal
to the `max_heap_size`. This is an invalid pointer
since there is no access allowed after the heap limit.

The way to provoke this was to repeatedly allocate
with sizes which were previously not allocated and
immediately deallocate right afterwards. What this
did was to increment the `bumper` with each allocation,
whilst keeping the `total_size` of the heap `0`.
If this repeated allocation/deallocation scheme resulted
in `max_heap_size == ptr` the `ptr` was still returned.

The allocator only checked if the `total_size` was
still within the `max_heap_size` limits, and not
if the resulting `ptr` was still within the valid
heap region.

This commit introduces a check to validate if the
calculated `ptr` is within the heap.
parent 03bfdc33
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment