From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Wed, 2 Sep 2026 23:12:01 +0000 (-0700)
Subject: Memory pool: allocate the block descriptor separately with the sanitizer
X-Git-Tag: 1.0.2~91
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=5614d8ef0bd8d6ef7e6f2c2a9798cc2b1954af89;p=njs.git

Memory pool: allocate the block descriptor separately with the sanitizer

Previously, njs_mp_alloc_large() embedded the block descriptor at the end of
the allocation for sizes which are not a power of two, so a read past the end
of an object stayed inside the malloc()ed region and was not detected by the
address sanitizer.

The fix is to always allocate the descriptor separately when the address
sanitizer is enabled.
---

diff --git a/src/njs_mp.c b/src/njs_mp.c
index 4288343e..f7e0df1d 100644
--- a/src/njs_mp.c
+++ b/src/njs_mp.c
@@ -585,6 +585,7 @@ njs_mp_alloc_large(njs_mp_t *mp, size_t alignment, size_t size)
     u_char          *p;
     size_t          aligned_size;
     uint8_t         type;
+    njs_bool_t      discrete;
     njs_mp_block_t  *block;
 
     /* Allocation must be less than 4G. */
@@ -600,7 +601,14 @@ njs_mp_alloc_large(njs_mp_t *mp, size_t alignment, size_t size)
     size += size == 0;
 #endif
 
-    if (njs_is_power_of_two(size)) {
+    discrete = njs_is_power_of_two(size);
+
+#if (NJS_HAVE_ADDRESS_SANITIZER)
+    /* Keep the sanitizer redzone right after the object. */
+    discrete = 1;
+#endif
+
+    if (discrete) {
         block = njs_malloc(sizeof(njs_mp_block_t));
         if (njs_slow_path(block == NULL)) {
             return NULL;