malloc_aligned() may not leave enough space for pointer to allocated memory,

saving the pointer will overwrite bytes belongs to another memory block
unexpectly, to fix the problem, use (allocated address + sizeof(void *)) as
initial value, and slip to next aligned address, so maximum extra bytes is
sizeof(void *) + align - 1.

Tested by: Andre Albsmeier < mail at ma17 dot ata dot myota dot orgndre >

1 files changed, 7 insertions, 7 deletions

diff --git a/libexec/rtld-elf/xmalloc.c b/libexec/rtld-elf/xmalloc.c
index 3b3408c..f8409e4 100644
--- a/libexec/rtld-elf/xmalloc.c
+++ b/libexec/rtld-elf/xmalloc.c
@@ -72,14 +72,14 @@ void *
 malloc_aligned(size_t size, size_t align)
 {
 	void *mem, *res;
-	uintptr_t x;
-	size_t asize, r;
 
-	r = round(sizeof(void *), align);
-	asize = round(size, align) + r;
-	mem = xmalloc(asize);
-	x = (uintptr_t)mem;
-	res = (void *)round(x, align);
+	if (align & (sizeof(void *) -1)) {
+		rtld_fdputstr(STDERR_FILENO, "Invalid alignment\n");
+		_exit(1);
+	}
+
+	mem = xmalloc(size + sizeof(void *) + align - 1);
+	res = (void *)round((uintptr_t)mem + sizeof(void *), align);
 	*(void **)((uintptr_t)res - sizeof(void *)) = mem;
 	return (res);
 }