211372d63a
The ISO C standard says about free(),
If ptr is a null pointer, no action occurs.
This is not true of the FreePool() interface of the MemoryAllocationLib
class:
Buffer must have been allocated on a previous call to the pool
allocation services of the Memory Allocation Library. [...] If Buffer
was not allocated with a pool allocation function in the Memory
Allocation Library, then ASSERT().
Therefore we must not forward the argument of free() to FreePool() without
checking.
This bug can be triggered by upstream OpenSSL commit 8e704858f219
("RT3955: Reduce some stack usage"), for example.
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Qin Long <qin.long@intel.com>
Cc: Ting Ye <ting.ye@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Qin Long <qin.long@intel.com>
49 lines
1.3 KiB
C
49 lines
1.3 KiB
C
/** @file
|
|
Base Memory Allocation Routines Wrapper for Crypto library over OpenSSL
|
|
during PEI & DXE phases.
|
|
|
|
Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
|
|
This program and the accompanying materials
|
|
are licensed and made available under the terms and conditions of the BSD License
|
|
which accompanies this distribution. The full text of the license may be found at
|
|
http://opensource.org/licenses/bsd-license.php
|
|
|
|
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
|
|
|
**/
|
|
|
|
#include <OpenSslSupport.h>
|
|
|
|
//
|
|
// -- Memory-Allocation Routines --
|
|
//
|
|
|
|
/* Allocates memory blocks */
|
|
void *malloc (size_t size)
|
|
{
|
|
return AllocatePool ((UINTN) size);
|
|
}
|
|
|
|
/* Reallocate memory blocks */
|
|
void *realloc (void *ptr, size_t size)
|
|
{
|
|
//
|
|
// BUG: hardcode OldSize == size! We have no any knowledge about
|
|
// memory size of original pointer ptr.
|
|
//
|
|
return ReallocatePool ((UINTN) size, (UINTN) size, ptr);
|
|
}
|
|
|
|
/* De-allocates or frees a memory block */
|
|
void free (void *ptr)
|
|
{
|
|
//
|
|
// In Standard C, free() handles a null pointer argument transparently. This
|
|
// is not true of FreePool() below, so protect it.
|
|
//
|
|
if (ptr != NULL) {
|
|
FreePool (ptr);
|
|
}
|
|
}
|