Merge 9ca3279507 into 1d7fc7ffe0

C23 declared calling realloc(3) with a non-NULL pointer and zero size
Undefined behavior.
Check that hardened_malloc handles that case sanely by free'ing the old
pointer and returning a special pointer, like `malloc(3)` called with
size zero.

h_malloc.c

@@ -1513,11 +1513,6 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
 }
 
 EXPORT void *h_realloc(void *old, size_t size) {
-    // deprecated in C17, UB since C23
-    if (unlikely(old != NULL && size == 0)) {
-        fatal_error("invalid zero sized realloc");
-    }
-
     size = adjust_size_for_canary(size);
     if (old == NULL) {
         return alloc(size);

test/.gitignore

@@ -42,4 +42,6 @@ uninitialized_read_large
 uninitialized_read_small
 realloc_init
 realloc_c23_undefined_behaviour
+realloc_c23_undefined_behaviour_double_free
+realloc_c23_undefined_behaviour_use_after_free
 __pycache__/

test/Makefile

@@ -68,7 +68,9 @@ EXECUTABLES := \
     invalid_malloc_object_size_small_quarantine \
     impossibly_large_malloc \
     realloc_init \
-    realloc_c23_undefined_behaviour
+    realloc_c23_undefined_behaviour \
+    realloc_c23_undefined_behaviour_double_free \
+    realloc_c23_undefined_behaviour_use_after_free
 
 all: $(EXECUTABLES)
 

test/realloc_c23_undefined_behaviour.c

@@ -1,16 +1,19 @@
+#include <stdio.h>
 #include <stdlib.h>
 
 #include "test_util.h"
 
 OPTNONE int main(void) {
-    void *p, *q;
+    char *p, *q, *r;
 
     p = malloc(16);
     if (!p) {
-        return -1;
+        return 1;
     }
 
     q = realloc(p, 0);
 
+    free(q);
+
     return 0;
 }

test/realloc_c23_undefined_behaviour_double_free.c

@@ -0,0 +1,19 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "test_util.h"
+
+OPTNONE int main(void) {
+    char *p, *q, *r;
+
+    p = malloc(16);
+    if (!p) {
+        return 1;
+    }
+
+    q = realloc(p, 0);
+
+    free(p);
+
+    return 0;
+}

test/realloc_c23_undefined_behaviour_use_after_free.c

@@ -0,0 +1,21 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "test_util.h"
+
+OPTNONE int main(void) {
+    char *p, *q, *r;
+
+    p = malloc(256 * 1024);
+    if (!p) {
+        return 1;
+    }
+
+    q = realloc(p, 0);
+
+    printf("%c\n", *p);
+
+    free(q);
+
+    return 0;
+}

test/test_smc.py

@@ -171,9 +171,17 @@ class TestSimpleMemoryCorruption(unittest.TestCase):
 
     def test_realloc_c23_undefined_behaviour(self):
         _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour")
+        self.assertEqual(returncode, 0)
+
+    def test_realloc_c23_undefined_behaviour_double_free(self):
+        _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour_double_free")
         self.assertEqual(returncode, -6)
         self.assertEqual(stderr.decode("utf-8"),
-                         "fatal allocator error: invalid zero sized realloc\n")
+                         "fatal allocator error: double free (quarantine)\n")
+
+    def test_realloc_c23_undefined_behaviour_use_after_free(self):
+        _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour_use_after_free")
+        self.assertEqual(returncode, -11)
 
     def test_write_after_free_large_reuse(self):
         _stdout, _stderr, returncode = self.run_test(