From 18530176a9797001bc1cb21b6d54c6885d48cc50 Mon Sep 17 00:00:00 2001
From: As9xm <197338912+As9xm@users.noreply.github.com>
Date: Thu, 10 Sep 2026 21:21:09 +0300
Subject: [PATCH] Fix aligned_realloc returning freed pointer (use-after-free)

my_safer_scalable_aligned_realloc and my_scalable_aligned_realloc grew the allocation via box_memalign+memcpy+box_free(p), then returned p instead of new_p. Callers received a dangling pointer while the live copy leaked, causing double-ownership, heap corruption, and crashes on TBB aligned growth. Return new_p.
---
 src/mallochook.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/mallochook.c b/src/mallochook.c
index 96c8495ee..75f70cf8d 100644
--- a/src/mallochook.c
+++ b/src/mallochook.c
@@ -692,7 +692,7 @@ EXPORT void* my_safer_scalable_aligned_realloc(void* p, size_t size, size_t alig
     void* new_p = box_memalign(align, size);
     memcpy(new_p, p, (old_size<size)?old_size:size);
     box_free(p);
-    return p;
+    return new_p;
 }
 
 EXPORT void my_safer_scalable_free(void*p , void* old)
@@ -740,7 +740,7 @@ EXPORT void* my_scalable_aligned_realloc(void* p, size_t size, size_t align)
     void* new_p = box_memalign(align, size);
     memcpy(new_p, p, (old_size<size)?old_size:size);
     box_free(p);
-    return p;
+    return new_p;
 }
 
 EXPORT size_t my_scalable_msize(void* p)