Skip to content
Commit 196911d4 authored by EunBong Song's avatar EunBong Song Committed by Gregory Nutt
Browse files

If size is greater than (UINT32_MAX - SIZEOF_MM_ALLOCNODE), malloc size can be... 

If size is greater than (UINT32_MAX - SIZEOF_MM_ALLOCNODE), malloc size can be overflow by MM_ALIGN_UP macro.  For example, if task_create() called with stack_size == -1, up_create_stack() functions allocates SIZEOF_MM_ALLOCNODE bytes for stack.
This can cause data abort in up_stack_color() function.
parent 5d6ecfa3
Hide whitespace changes
Inline Side-by-side
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment