From c8397ae8171f00dcfb071130e6ea2b64aea17ded Mon Sep 17 00:00:00 2001 From: Henrik Nilsson via Newlib Date: Fri, 17 Feb 2023 06:56:49 +0100 Subject: [PATCH] nano-mallocr: Prevent NULL pointer de-reference in free_list The existing code checked if there was a chunk in free_list and that the tail was not the next chunk. The check if there is a chunk is not needed since it's already known but the case of a single chunk in free_list needs to be handled differently. --- newlib/libc/stdlib/nano-mallocr.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c index b2273ba60..a2b50facc 100644 --- a/newlib/libc/stdlib/nano-mallocr.c +++ b/newlib/libc/stdlib/nano-mallocr.c @@ -333,14 +333,23 @@ void * nano_malloc(RARG malloc_size_t s) { p->size += alloc_size; - /* Remove chunk from free_list */ + /* Remove chunk from free_list. Since p != NULL there is + at least one chunk */ r = free_list; - while (r && p != r->next) + if (r->next == NULL) { - r = r->next; + /* There is only a single chunk, remove it */ + free_list = NULL; + } + else + { + /* Search for the chunk before the one to be removed */ + while (p != r->next) + { + r = r->next; + } + r->next = NULL; } - r->next = NULL; - r = p; } else