Google Git
Sign in
llvm/scudo/177644e7ef9865133ab3abe1654a5e94ab12dfb1
commit
177644e7ef9865133ab3abe1654a5e94ab12dfb1
[log]
author
Christopher Ferris <cferris1000@users.noreply.github.com>
Tue Jun 16 22:55:09 2026 +0000
committer
Copybara-Service <copybara-worker@google.com>
Tue Jun 16 16:00:17 2026 -0700
tree
cce6330eb98dd4550667087fe79ca045c75336a6
parent
f5a5b10988ba59095256354a93688f962feca008 [diff]
[scudo] For a realloc that shrinks, retag the extra. (#204031)

When MTE is enabled and an allocations is reallocated from a large size
to a smaller size, zero tag the rest of the allocation. Before this
change only a single granule after the new size was zero tagged. This
adds extra security and use after realloc protection if code would have
tried to read/write into the old size, past the new size.

GitOrigin-RevId: 5639b33d7567bf648f27418b126f5f6f6292b730
2 files changed
tree: cce6330eb98dd4550667087fe79ca045c75336a6
  1. fuzz/
  2. include/
  3. tests/
  4. tools/
  5. allocator_common.h
  6. allocator_config.def
  7. allocator_config.h
  8. allocator_config_wrapper.h
  9. atomic_helpers.h
  10. bytemap.h
  11. checksum.cpp
  12. checksum.h
  13. chunk.h
  14. combined.h
  15. common.cpp
  16. common.h
  17. condition_variable.h
  18. condition_variable_base.h
  19. condition_variable_linux.cpp
  20. condition_variable_linux.h
  21. crc32_hw.cpp
  22. flags.cpp
  23. flags.h
  24. flags.inc
  25. flags_parser.cpp
  26. flags_parser.h
  27. fuchsia.cpp
  28. fuchsia.h
  29. internal_defs.h
  30. LICENSE.TXT
  31. linux.cpp
  32. linux.h
  33. list.h
  34. mem_map.cpp
  35. mem_map.h
  36. mem_map_base.h
  37. mem_map_fuchsia.cpp
  38. mem_map_fuchsia.h
  39. mem_map_linux.cpp
  40. mem_map_linux.h
  41. memtag.h
  42. mutex.h
  43. options.h
  44. platform.h
  45. primary32.h
  46. primary64.h
  47. quarantine.h
  48. release.cpp
  49. release.h
  50. report.cpp
  51. report.h
  52. report_linux.cpp
  53. report_linux.h
  54. secondary.h
  55. size_class_allocator.h
  56. size_class_map.h
  57. stack_depot.h
  58. stats.h
  59. string_utils.cpp
  60. string_utils.h
  61. thread_annotations.h
  62. timing.cpp
  63. timing.h
  64. tracing.h
  65. trusty.cpp
  66. trusty.h
  67. tsd.h
  68. tsd_exclusive.h
  69. tsd_shared.h
  70. type_traits.h
  71. vector.h
  72. wrappers_c.cpp
  73. wrappers_c.h
  74. wrappers_c_checks.h
  75. wrappers_cpp.cpp