Skip to content

check realloc result before zeroing grown bytes in loader_realloc#1940

Open
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:realloc-null-check-grow
Open

check realloc result before zeroing grown bytes in loader_realloc#1940
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:realloc-null-check-grow

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Was tracing the generic-list growth paths and stopped on loader_realloc.

  1. on the default path we store realloc(pMemory, size) in pNewMem, then zero the grown tail with memset((uint8_t *)pNewMem + orig_size, 0, size - orig_size) whenever size > orig_size.
  2. realloc hands back NULL on failure and leaves the original block untouched, so under OOM pNewMem is NULL and that memset writes through a null pointer at offset orig_size before we ever return.

The callers all check the returned pointer for NULL, so only the zero-fill inside loader_realloc touches it early. Guarded the memset on pNewMem so the tail is only cleared when realloc actually returned the resized block. Behaviour is unchanged on success.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 13055.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3573 running.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants