Improve heap2 bounds checking (#224)
* Improve heap bounds checking in pvPortMalloc
diff --git a/portable/MemMang/heap_1.c b/portable/MemMang/heap_1.c
index 4a7f8c2..2b73463 100644
--- a/portable/MemMang/heap_1.c
+++ b/portable/MemMang/heap_1.c
@@ -22,7 +22,6 @@
* https://www.FreeRTOS.org
* https://github.com/FreeRTOS
*
- * 1 tab == 4 spaces!
*/
@@ -72,13 +71,20 @@
void * pvReturn = NULL;
static uint8_t * pucAlignedHeap = NULL;
- /* Ensure that blocks are always aligned to the required number of bytes. */
+ /* Ensure that blocks are always aligned. */
#if ( portBYTE_ALIGNMENT != 1 )
{
if( xWantedSize & portBYTE_ALIGNMENT_MASK )
{
- /* Byte alignment required. */
- xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ /* Byte alignment required. Check for overflow. */
+ if ( (xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) )) > xWantedSize )
+ {
+ xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ }
+ else
+ {
+ xWantedSize = 0;
+ }
}
}
#endif
@@ -91,8 +97,9 @@
pucAlignedHeap = ( uint8_t * ) ( ( ( portPOINTER_SIZE_TYPE ) & ucHeap[ portBYTE_ALIGNMENT ] ) & ( ~( ( portPOINTER_SIZE_TYPE ) portBYTE_ALIGNMENT_MASK ) ) );
}
- /* Check there is enough room left for the allocation. */
- if( ( ( xNextFreeByte + xWantedSize ) < configADJUSTED_HEAP_SIZE ) &&
+ /* Check there is enough room left for the allocation and. */
+ if( ( xWantedSize > 0 ) && /* valid size */
+ ( ( xNextFreeByte + xWantedSize ) < configADJUSTED_HEAP_SIZE ) &&
( ( xNextFreeByte + xWantedSize ) > xNextFreeByte ) ) /* Check for overflow. */
{
/* Return the next free byte then increment the index past this
diff --git a/portable/MemMang/heap_2.c b/portable/MemMang/heap_2.c
index 640cd54..e132ae3 100644
--- a/portable/MemMang/heap_2.c
+++ b/portable/MemMang/heap_2.c
@@ -22,7 +22,6 @@
* https://www.FreeRTOS.org
* https://github.com/FreeRTOS
*
- * 1 tab == 4 spaces!
*/
/*
@@ -132,21 +131,32 @@
xHeapHasBeenInitialised = pdTRUE;
}
- /* The wanted size is increased so it can contain a BlockLink_t
+ /* The wanted size must be increased so it can contain a BlockLink_t
* structure in addition to the requested amount of bytes. */
- if( xWantedSize > 0 )
+ if( ( xWantedSize > 0 ) &&
+ ( ( xWantedSize + heapSTRUCT_SIZE ) > xWantedSize ) ) /* Overflow check */
{
xWantedSize += heapSTRUCT_SIZE;
- /* Ensure that blocks are always aligned to the required number of bytes. */
- if( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) != 0 )
+ /* Byte alignment required. Check for overflow. */
+ if( ( xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) )
+ > xWantedSize )
{
- /* Byte alignment required. */
xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ configASSERT( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) == 0 );
}
+ else
+ {
+ xWantedSize = 0;
+ }
+ }
+ else
+ {
+ xWantedSize = 0;
}
- if( ( xWantedSize > 0 ) && ( xWantedSize < configADJUSTED_HEAP_SIZE ) )
+
+ if( ( xWantedSize > 0 ) && ( xWantedSize <= xFreeBytesRemaining ) )
{
/* Blocks are stored in byte order - traverse the list from the start
* (smallest) block until one of adequate size is found. */
diff --git a/portable/MemMang/heap_4.c b/portable/MemMang/heap_4.c
index 7e5357c..2a1ee20 100644
--- a/portable/MemMang/heap_4.c
+++ b/portable/MemMang/heap_4.c
@@ -136,34 +136,42 @@
* kernel, so it must be free. */
if( ( xWantedSize & xBlockAllocatedBit ) == 0 )
{
- /* The wanted size is increased so it can contain a BlockLink_t
+ /* The wanted size must be increased so it can contain a BlockLink_t
* structure in addition to the requested amount of bytes. */
- if( xWantedSize > 0 )
+ if( ( xWantedSize > 0 ) &&
+ ( ( xWantedSize + xHeapStructSize ) > xWantedSize ) ) /* Overflow check */
{
xWantedSize += xHeapStructSize;
- /* Ensure that blocks are always aligned to the required number
- * of bytes. */
+ /* Ensure that blocks are always aligned. */
if( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) != 0x00 )
{
- /* Byte alignment required. */
- xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
- configASSERT( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) == 0 );
+ /* Byte alignment required. Check for overflow. */
+ if( ( xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) )
+ > xWantedSize )
+ {
+ xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ configASSERT( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) == 0 );
+ }
+ else
+ {
+ xWantedSize = 0;
+ }
}
else
{
mtCOVERAGE_TEST_MARKER();
}
- }
- else
+ }
+ else
{
- mtCOVERAGE_TEST_MARKER();
+ xWantedSize = 0;
}
if( ( xWantedSize > 0 ) && ( xWantedSize <= xFreeBytesRemaining ) )
{
/* Traverse the list from the start (lowest address) block until
- * one of adequate size is found. */
+ * one of adequate size is found. */
pxPreviousBlock = &xStart;
pxBlock = xStart.pxNextFreeBlock;
@@ -174,7 +182,7 @@
}
/* If the end marker was reached then a block of adequate size
- * was not found. */
+ * was not found. */
if( pxBlock != pxEnd )
{
/* Return the memory space pointed to - jumping over the
diff --git a/portable/MemMang/heap_5.c b/portable/MemMang/heap_5.c
index 90c0b5b..fe194a6 100644
--- a/portable/MemMang/heap_5.c
+++ b/portable/MemMang/heap_5.c
@@ -22,7 +22,6 @@
* https://www.FreeRTOS.org
* https://github.com/FreeRTOS
*
- * 1 tab == 4 spaces!
*/
/*
@@ -150,16 +149,24 @@
{
/* The wanted size is increased so it can contain a BlockLink_t
* structure in addition to the requested amount of bytes. */
- if( xWantedSize > 0 )
+ if( ( xWantedSize > 0 ) &&
+ ( ( xWantedSize + xHeapStructSize ) > xWantedSize ) ) /* Overflow check */
{
xWantedSize += xHeapStructSize;
- /* Ensure that blocks are always aligned to the required number
- * of bytes. */
+ /* Ensure that blocks are always aligned */
if( ( xWantedSize & portBYTE_ALIGNMENT_MASK ) != 0x00 )
{
- /* Byte alignment required. */
- xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ /* Byte alignment required. Check for overflow */
+ if( ( xWantedSize + ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) ) ) >
+ xWantedSize )
+ {
+ xWantedSize += ( portBYTE_ALIGNMENT - ( xWantedSize & portBYTE_ALIGNMENT_MASK ) );
+ }
+ else
+ {
+ xWantedSize = 0;
+ }
}
else
{
@@ -168,13 +175,13 @@
}
else
{
- mtCOVERAGE_TEST_MARKER();
+ xWantedSize = 0;
}
if( ( xWantedSize > 0 ) && ( xWantedSize <= xFreeBytesRemaining ) )
{
/* Traverse the list from the start (lowest address) block until
- * one of adequate size is found. */
+ * one of adequate size is found. */
pxPreviousBlock = &xStart;
pxBlock = xStart.pxNextFreeBlock;
@@ -185,7 +192,7 @@
}
/* If the end marker was reached then a block of adequate size
- * was not found. */
+ * was not found. */
if( pxBlock != pxEnd )
{
/* Return the memory space pointed to - jumping over the
