rt_malloc_align函数内存越界问题

发布于 2025-05-13 10:03:29 浏览：47 订阅该版

~~~
void *rt_malloc_align(rt_size_t size, rt_size_t align)
{
    void *align_ptr;
    void *ptr;
    rt_size_t align_size;

/* align the alignment size to 4 byte */
    align = ((align + 0x03) & ~0x03);

/* get total aligned size */
    align_size = ((size + 0x03) & ~0x03) + align;
    /* allocate memory block from heap */
    ptr = rt_malloc(align_size);
    if (ptr != RT_NULL)
    {
        /* the allocated memory block is aligned */
        if (((rt_uint32_t)ptr & (align - 1)) == 0)
        {
            align_ptr = (void *)((rt_uint32_t)ptr + align);
        }
        else
        {
            align_ptr = (void *)(((rt_uint32_t)ptr + (align - 1)) & ~(align - 1));
        }

/* set the pointer before alignment pointer to the real pointer */
        *((rt_uint32_t *)((rt_uint32_t)align_ptr - sizeof(void *))) = (rt_uint32_t)ptr;

ptr = align_ptr;
    }

return ptr;
}
~~~

代码如上所示。
条件：align = 4，rt_malloc申请到的内存地址为0x2000001，`sizeof(void*) = 4`
结果： `align_ptr = 0x2000004`
则： `*((rt_uint32_t *)((rt_uint32_t)align_ptr - sizeof(void *))) = (rt_uint32_t)ptr;`

用`0x2000000~0x2000003`四个字节用来保存真实申请的内存地址（0x2000001），而0x2000000并不是申请到的内存，会造成内存越界操作。