libstdc++ ensures aligned new detects size_t overflow (CVE-2026-95619)
Fixes a vulnerability in aligned memory allocation that could lead to returning memory of insufficient size.
Aligned memory allocation functions in libstdc++ could return a pointer to memory smaller than requested due to size_t overflow during size rounding. This commit introduces checks for such overflows in various aligned allocation implementations, including fallback mechanisms and platform-specific functions like _aligned_malloc on Windows. This prevents the allocation of undersized buffers, enhancing memory safety.
In Details
This commit addresses a size_t overflow vulnerability in libstdc++'s aligned allocation (operator new with alignment). For targets lacking posix_memalign, aligned_alloc or custom malloc-based implementations are used. The vulnerability arises when rounding the requested size up to a multiple of alignment results in wraparound, leading to a smaller, successfully allocated buffer. The fix ensures overflow checks are performed before allocation, particularly in __gnu_cxx::aligned_alloc and its wrappers, to prevent returning incorrectly sized memory and instead throw std::bad_alloc.
- size_t
- An unsigned integer type that is large enough to contain the size of any object in bytes. It's used for memory sizes and counts.
- std::bad_alloc
- An exception class thrown by the C++ standard library when memory allocation fails. This indicates that the program could not allocate the requested amount of memory.
- posix_memalign
- A POSIX standard function that allocates memory with alignment constraints. It's a common and safe way to handle aligned memory requests.
- aligned_alloc
- A C11 standard function for allocating memory with specified alignment. GCC uses this on some platforms when posix_memalign is not available.
- _aligned_malloc
- A Microsoft-specific function for allocating memory with specified alignment. Used by GCC on Windows targets.