blawrence-ont de3c6ec646 Fix use-after-free in mappy (#1345) ...

mm_map_aux() takes in |b._b| which can end up reallocating |km| at the
end of mm_map_frag_core(). Since the address of |km| is cached before
those calls it ends up pointing to freed memory.

This can result in a crash as seen in #1183, however it also happens to
Just Work most of the time since the new allocation often lands at the
same address as the old one. Preloading ASAN or a similar replacement
allocator that doesn't have that behaviour results in a reliable crash.

2026-02-13 12:14:56 -05:00

9.6 KiB

Raw Blame History

View Raw