Skip to content

Commit 834644c

Browse files
committed
Fix umm_poison data corruption on realloc when memory move is used.
Bug introduced with PR fix esp8266#8914
1 parent cda2320 commit 834644c

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

cores/esp8266/umm_malloc/umm_malloc.cpp

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1089,7 +1089,9 @@ void *umm_realloc(void *ptr, size_t size) {
10891089
STATS__FREE_BLOCKS_UPDATE(-prevBlockSize);
10901090
STATS__FREE_BLOCKS_ISR_MIN();
10911091
blockSize += prevBlockSize;
1092-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size); // Fix new allocation so poison check from an ISR passes.
1092+
// Fix new allocation such that poison checks from an ISR pass.
1093+
size_t super_size = (blockSize * sizeof(umm_block)) - (sizeof(((umm_block *)0)->header));
1094+
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), super_size);
10931095
UMM_CRITICAL_SUSPEND(id_realloc);
10941096
UMM_POISON_MEMMOVE((void *)&UMM_DATA(c), ptr, curSize);
10951097
ptr = (void *)&UMM_DATA(c);
@@ -1111,7 +1113,8 @@ void *umm_realloc(void *ptr, size_t size) {
11111113
#else
11121114
blockSize += (prevBlockSize + nextBlockSize);
11131115
#endif
1114-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size);
1116+
size_t super_size = (blockSize * sizeof(umm_block)) - (sizeof(((umm_block *)0)->header));
1117+
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), super_size);
11151118
UMM_CRITICAL_SUSPEND(id_realloc);
11161119
UMM_POISON_MEMMOVE((void *)&UMM_DATA(c), ptr, curSize);
11171120
ptr = (void *)&UMM_DATA(c);
@@ -1186,7 +1189,9 @@ void *umm_realloc(void *ptr, size_t size) {
11861189
blockSize = blocks;
11871190
#endif
11881191
}
1189-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size);
1192+
// Fix new allocation such that poison checks from an ISR pass.
1193+
size_t super_size = (blockSize * sizeof(umm_block)) - (sizeof(((umm_block *)0)->header));
1194+
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), super_size);
11901195
UMM_CRITICAL_SUSPEND(id_realloc);
11911196
UMM_POISON_MEMMOVE((void *)&UMM_DATA(c), ptr, curSize);
11921197
ptr = (void *)&UMM_DATA(c);

0 commit comments

Comments
 (0)