SimpleHeapAllocator bug when splitting blocks allowed memory overrun.

c3lang · Nov 21, 2024 · 22f7faf · 22f7faf
1 parent f3bf9eb
commit 22f7faf
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/lib/std/core/allocators/heap_allocator.c3 b/lib/std/core/allocators/heap_allocator.c3
@@ -98,7 +98,7 @@ fn void*! SimpleHeapAllocator._alloc(&self, usz bytes) @local
 				return current + 1;
 			case current.size > aligned_bytes:
 				Header* unallocated = (Header*)((char*)current + aligned_bytes + Header.sizeof);
-				unallocated.size = current.size - aligned_bytes;
+				unallocated.size = current.size - aligned_bytes - Header.sizeof;
 				unallocated.next = current.next;
 				if (current == self.free_list)
 				{

diff --git a/releasenotes.md b/releasenotes.md
@@ -18,6 +18,7 @@
 - Fix issue with overloaded subscript and ++/--.
 - Fix issue with properties in different targets not being respected #1633.
 - Indexing an Optional slice would crash in codegen #1636.
+- SimpleHeapAllocator bug when splitting blocks allowed memory overrun.
 
 ### Stdlib changes
 - Add `io::MultiReader`, `io::MultiWriter`, and `io::TeeReader` structs.