Commit 41430a366f

Erik Arvstedt <erik.arvstedt@gmail.com>
2023-06-12 22:21:29
arena_allocator/reset: fix buffer overrun
Previously, the buffer reserved with `retain_with_limit` was missing space for the `BufNode`. When the user-provided a limit that was smaller than `@sizeOf(BufNode)`, `reset` would store a new `BufNode` in an allocation smaller than `BufNode`, leading to a buffer overrun.
master
1 parent c16d4ab
Changed files (1)
lib
std
heap
arena_allocator.zig
lib/std/heap/arena_allocator.zig
@@ -120,7 +120,7 @@ pub const ArenaAllocator = struct {
         }
         const total_size = switch (mode) {
             .retain_capacity => current_capacity,
-            .retain_with_limit => |limit| std.math.min(limit, current_capacity),
+            .retain_with_limit => |limit| std.math.min(@sizeOf(BufNode) + limit, current_capacity),
             .free_all => unreachable,
         };
         const align_bits = std.math.log2_int(usize, @alignOf(BufNode));