New issue
Advanced search Search tips

Issue 709271 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

DCHECK in PartitionCookieCheckValue after reallocating buffer.

Project Member Reported by tsepez@chromium.org, Apr 6 2017

Issue description

When partitonalloc is built with "cookies", it stamps a value at the beginning and end of each allocation.  However, there is a problem with the reallocation path at https://cs.chromium.org/chromium/src/base/allocator/partition_allocator/partition_alloc.cc?l=1052

  if (actual_new_size == actual_old_size) {
    // Trying to allocate a block of size new_size would give us a block of
    // the same size as the one we've already got, so no point in doing
    // anything here.
    return ptr;
  }


When this is taken, the end cookie needs to be moved out of harm's way
since it will be overwritten by the caller when using the full size.

Additionally, the raw size bookkeeping needs to be updated to account for the new location of the cookie.



 
To trip this condition, the raw allocation must be larger enough so that the raw size bookkeeping is active (typically 64k) at

https://cs.chromium.org/chromium/src/base/allocator/partition_allocator/partition_alloc.h?rcl=a7c962cd009df5796428aa072e9a41603526ca71&l=625
Cc: haraken@chromium.org
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)
CL at https://codereview.chromium.org/2799323003/

Comment 4 by tsepez@chromium.org, Apr 11 2017

Status: Fixed (was: Assigned)

Sign in to add a comment