Merge branch 'hotfix/0.12.1'

guillaumeblanc · Mar 16, 2020 · 3385ddf · 3385ddf
2 parents 3b2192b + 49df736
commit 3385ddf
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 5 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,3 +1,9 @@
+Release version 0.12.1
+----------------------
+
+* Library
+  - [base] Fixes memory overwrite when reallocating a buffer of smaller size using ozz default memory allocator.
+
 Release version 0.12.0
 ----------------------
 

diff --git a/src/base/memory/allocator.cc b/src/base/memory/allocator.cc
@@ -91,10 +91,12 @@ class HeapAllocator : public Allocator {
     if (_block) {
       Header* old_header = reinterpret_cast<Header*>(
           reinterpret_cast<char*>(_block) - sizeof(Header));
-      memcpy(new_block, _block, old_header->size);
-      free(old_header->unaligned);
+
+      // Copy previous content, which might not fit in the new one.
+      memcpy(new_block, _block, math::Min(_size, old_header->size));
 
       // Deallocation completed.
+      free(old_header->unaligned);
       --allocation_count_;
     }
     return new_block;

diff --git a/test/base/memory/allocator_tests.cc b/test/base/memory/allocator_tests.cc
@@ -39,12 +39,17 @@ TEST(Allocate, Memory) {
   // Fills allocated memory.
   memset(p, 0, 12);
 
-  p = ozz::memory::default_allocator()->Reallocate(p, 46, 4096);
+  // Bigger
+  p = ozz::memory::default_allocator()->Reallocate(p, 460, 4096);
   EXPECT_TRUE(p != NULL);
   EXPECT_TRUE(ozz::math::IsAligned(p, 4096));
+  memset(p, 0, 460);
 
-  // Fills allocated memory.
-  memset(p, 0, 46);
+  // Smaller
+  p = ozz::memory::default_allocator()->Reallocate(p, 4, 4);
+  EXPECT_TRUE(p != NULL);
+  EXPECT_TRUE(ozz::math::IsAligned(p, 4));
+  memset(p, 0, 4);
 
   ozz::memory::default_allocator()->Deallocate(p);
 }