Commit Graph
2 Commits
Author SHA1 Message Date
blawrence-ont de3c6ec646 Fix use-after-free in mappy (#1345)
mm_map_aux() takes in |b._b| which can end up reallocating |km| at the
end of mm_map_frag_core(). Since the address of |km| is cached before
those calls it ends up pointing to freed memory.

This can result in a crash as seen in #1183, however it also happens to
Just Work most of the time since the new allocation often lands at the
same address as the old one. Preloading ASAN or a similar replacement
allocator that doesn't have that behaviour results in a reliable crash.
2026-02-13 12:14:56 -05:00
blawrence-ont f3e59fc2a0 Avoid NULL pointer dereference (#1154)
If the allocated region is 0 bytes then it's unsafe to dereference it.

Fixes #1147.
2024-01-24 12:32:05 -05:00