Skip to content

slice_count overflow for very large allocations #876

Closed
Closed
slice_count overflow for very large allocations#876

Description

@colesbury
Sam Gross (colesbury)
opened on Apr 12, 2024

This was seen in python/cpython#117755 on s390x (Linux on IBMz) for an allocation of 0x7fffffffffffffff bytes:

mimalloc/src/segment.c

Lines 617 to 618 in f199b88

slice->slice_count = (uint32_t)slice_count;
mi_assert_internal(slice->slice_count == slice_count); // no overflow?

The mi_segment_os_alloc is successful (possibly due to overcommit), but then the slice_count is truncated, which leads to either an assertion error (in debug builds) or floating point error due to a divide by zero.

Activity

  1. Victor Stinner (vstinner)
    added 2 commits that reference this issue on Apr 15, 2024

    Issue microsoft#876: Fix integer overflow on slice_count

    8b8057e

    Issue microsoft#876: Fix integer overflow on slice_count

    84ceba4

  2. vstinner commented on Apr 15, 2024

    @vstinner
    Victor Stinner (vstinner)
    on Apr 15, 2024

    I proposed a fix: #877

  3. daanx commented on Apr 19, 2024

    @daanx
    Daan (daanx)
    on Apr 19, 2024
    Collaborator

    Ah, that is a terrible bug but I just merged a fix. I am going to do a fresh release tag soon.
    Thanks so much!

  4. Daan (daanx)
    closed this as completedon Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions