From 52755632528d819147985bfe15a11849287f1634 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Wed, 6 Jan 2021 00:12:17 -0500 Subject: [PATCH] fix C++ sized deallocation check false positive This is a compatibility issue triggered when both slab canaries and the C++ allocator overloads providing sized deallocation checks are enabled. The boundary where slab allocations are turned into large allocations due to not having room for the canary in the largest slab allocation size class triggers a false positive in the sized deallocation check. --- h_malloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/h_malloc.c b/h_malloc.c index 48cf7e5..625ca5f 100644 --- a/h_malloc.c +++ b/h_malloc.c @@ -1552,9 +1552,11 @@ EXPORT void h_free_sized(void *p, size_t expected_size) { return; } + expected_size = adjust_size_for_canaries(expected_size); + if (p < get_slab_region_end() && p >= ro.slab_region_start) { thread_unseal_metadata(); - expected_size = get_size_info(adjust_size_for_canaries(expected_size)).size; + expected_size = get_size_info(expected_size).size; deallocate_small(p, &expected_size); thread_seal_metadata(); return;