TCMalloc: restrict maximum size of memory ranges

third_party/tcmalloc/chromium/src/page_heap.cc

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 449 matching lines @@
   t->depth = GetStackTrace(t->stack, kMaxStackDepth-1, 3);
   t->size = growth;
   t->stack[kMaxStackDepth-1] = reinterpret_cast<void*>(Static::growth_stacks());
   Static::set_growth_stacks(t);
 }
 
 bool PageHeap::GrowHeap(Length n) {
   ASSERT(kMaxPages >= kMinSystemAlloc);
   if (n > kMaxValidPages) return false;
   Length ask = (n>kMinSystemAlloc) ? n : static_cast<Length>(kMinSystemAlloc);
+  // For most allocators it's ok to check for size here as they won't generally
+  // grow existing mappings. Some implementations, such as the Linux brk heap
+  // implementation will however require additional checks.
+  if (!IsContiguousAllocSizePermitted(n << kPageShift))
+    return false;
   size_t actual_size;
   void* ptr = TCMalloc_SystemAlloc(ask << kPageShift, &actual_size, kPageSize);
   if (ptr == NULL) {
     if (n < ask) {
       // Try growing just "n" pages
       ask = n;
       ptr = TCMalloc_SystemAlloc(ask << kPageShift, &actual_size, kPageSize);
     }
     if (ptr == NULL) return false;
   }
@@ skipping 57 matching lines @@
     CHECK_CONDITION(s->location == freelist);  // NORMAL or RETURNED
     CHECK_CONDITION(s->length >= min_pages);
     CHECK_CONDITION(s->length <= max_pages);
     CHECK_CONDITION(GetDescriptor(s->start) == s);
     CHECK_CONDITION(GetDescriptor(s->start+s->length-1) == s);
   }
   return true;
 }
 
 }  // namespace tcmalloc