Merge 5f7e7dad20 into 1d7fc7ffe0

h_malloc.c

@@ -1513,6 +1513,11 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
 }
 
 EXPORT void *h_realloc(void *old, size_t size) {
+    // deprecated in C17, UB since C23
+    if (unlikely(old != NULL && size == 0)) {
+        fatal_error("invalid zero sized realloc");
+    }
+
     size = adjust_size_for_canary(size);
     if (old == NULL) {
         return alloc(size);

test/.gitignore

@@ -42,6 +42,4 @@ uninitialized_read_large
 uninitialized_read_small
 realloc_init
 realloc_c23_undefined_behaviour
-realloc_c23_undefined_behaviour_double_free
-realloc_c23_undefined_behaviour_use_after_free
 __pycache__/

test/Makefile

@@ -68,9 +68,7 @@ EXECUTABLES := \
     invalid_malloc_object_size_small_quarantine \
     impossibly_large_malloc \
     realloc_init \
-    realloc_c23_undefined_behaviour \
+    realloc_c23_undefined_behaviour
-    realloc_c23_undefined_behaviour_double_free \
-    realloc_c23_undefined_behaviour_use_after_free
 
 all: $(EXECUTABLES)
 

test/realloc_c23_undefined_behaviour.c

@@ -1,19 +1,16 @@
-#include <stdio.h>
 #include <stdlib.h>
 
 #include "test_util.h"
 
 OPTNONE int main(void) {
-    char *p, *q, *r;
+    void *p, *q;
 
     p = malloc(16);
     if (!p) {
-        return 1;
+        return -1;
     }
 
     q = realloc(p, 0);
 
-    free(q);
-
     return 0;
 }

test/realloc_c23_undefined_behaviour_double_free.c

@@ -1,19 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-
-#include "test_util.h"
-
-OPTNONE int main(void) {
-    char *p, *q, *r;
-
-    p = malloc(16);
-    if (!p) {
-        return 1;
-    }
-
-    q = realloc(p, 0);
-
-    free(p);
-
-    return 0;
-}

test/realloc_c23_undefined_behaviour_use_after_free.c

@@ -1,21 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-
-#include "test_util.h"
-
-OPTNONE int main(void) {
-    char *p, *q, *r;
-
-    p = malloc(256 * 1024);
-    if (!p) {
-        return 1;
-    }
-
-    q = realloc(p, 0);
-
-    printf("%c\n", *p);
-
-    free(q);
-
-    return 0;
-}

test/test_smc.py

@@ -171,17 +171,9 @@ class TestSimpleMemoryCorruption(unittest.TestCase):
 
     def test_realloc_c23_undefined_behaviour(self):
         _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour")
-        self.assertEqual(returncode, 0)
-
-    def test_realloc_c23_undefined_behaviour_double_free(self):
-        _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour_double_free")
         self.assertEqual(returncode, -6)
         self.assertEqual(stderr.decode("utf-8"),
-                         "fatal allocator error: double free (quarantine)\n")
+                         "fatal allocator error: invalid zero sized realloc\n")
-
-    def test_realloc_c23_undefined_behaviour_use_after_free(self):
-        _stdout, stderr, returncode = self.run_test("realloc_c23_undefined_behaviour_use_after_free")
-        self.assertEqual(returncode, -11)
 
     def test_write_after_free_large_reuse(self):
         _stdout, _stderr, returncode = self.run_test(