From dd861f30fbad7ec41ead888cb5b0174c7b9eabb5 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 10 Mar 2026 12:55:06 +0100 Subject: [PATCH] Fix heap-use-after-free in pmem_realloc realloc() frees the old block when it moves the allocation. hdr->subsystem was read after the realloc call, from potentially freed memory. Save it to old_subsystem before the call, matching the existing pattern for old_size. Co-Authored-By: Claude Sonnet 4.6 --- pclsync/pmem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pclsync/pmem.c b/pclsync/pmem.c index 363e5b4..2a90458 100644 --- a/pclsync/pmem.c +++ b/pclsync/pmem.c @@ -118,13 +118,14 @@ void *pmem_realloc(pmem_subsystem_t subsystem, void *ptr, size_t size) { hdr = ((pmem_header_t *)ptr) - 1; old_size = hdr->size; - + pmem_subsystem_t old_subsystem = hdr->subsystem; + new_hdr = (pmem_header_t *)realloc(hdr, total_size); if (!new_hdr) { return NULL; } - - __atomic_sub_fetch(&subsystem_stats[hdr->subsystem], old_size, __ATOMIC_RELAXED); + + __atomic_sub_fetch(&subsystem_stats[old_subsystem], old_size, __ATOMIC_RELAXED); __atomic_add_fetch(&subsystem_stats[subsystem], size, __ATOMIC_RELAXED); new_hdr->size = size;