FastMM4 Allocation Size Overflow in FullDebugMode
Developer security advisory. Issue #104. Published: August 16, 2026. Fixed on upstream master in commit b09f74b; not yet released.
Summary
When FastMM4 is compiled with FullDebugMode, adding the debug-block overhead to a near-maximum allocation size can overflow. The wrapped value can cause the underlying allocator to return a block much smaller than requested. FastMM4 then uses the original size to locate the debug footer and can write it outside the allocation before returning.
DebugReallocMem contains the same unsafe addition in its in-place size test. Builds without FullDebugMode are not affected by this defect.
Severity: Medium (CVSS 4.0 Score: 5.8). No CVE has been assigned.
Vulnerability Details
| Issue | FastMM4 issue #104 |
|---|---|
| Related Advisory | GHSA-p7fj-xpgj-24qm , published for the inherited FastMM4-AVX defect |
| Pull Request | FastMM4 pull request #103 |
| Vulnerability Type | Integer Overflow or Wraparound (CWE-190) and Integer Overflow to Buffer Overflow (CWE-680), leading to an Out-of-bounds Write (CWE-787) |
| Product | FastMM4 Memory Manager |
| Affected Component | DebugGetMem and DebugReallocMem in FastMM4.pas, reached only in FullDebugMode |
| Affected Versions | FastMM4 4.993 and earlier releases. Upstream master before commit b09f74b is also affected. |
| Fix Status | Fixed directly on upstream master in commit b09f74b . Pull request #103 was closed without merge after the maintainer applied the guards directly. Issue #104 is complete. No published upstream release contains the fix yet. |
| Impact | Out-of-bounds footer write, allocator metadata corruption, further memory corruption, or process termination |
CVSS Score
| Version | CVSS 4.0 |
|---|---|
| Score | 5.8 Medium |
| Vector | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
The vector describes a local application built with FullDebugMode. No network-reachable path, confidentiality loss, or cross-system impact has been demonstrated.
Technical Details
Root Cause
DebugGetMem adds the overhead before checking whether the sum is representable:
Result := FastGetMem(ASize + FullDebugBlockOverhead);
DebugReallocMem performs the corresponding unsafe calculation in its size test:
if LBlockSpace < (NativeUInt(ANewSize) + FullDebugBlockOverhead) then
When the first sum wraps, the underlying allocator can return a small block. The footer address is then derived from the original near-maximum size and points outside that block.
Reproduction
The defect was reproduced in original FastMM4 with Delphi 7 and FullDebugMode. An allocation of High(NativeUInt) returned a pointer before the process terminated:
Attempting to allocate: $FFFFFFFF bytes (High(NativeUInt))
[FAIL] High(NativeUInt) allocation - VULNERABILITY: got pointer $7FE91940
Runtime error 204
The patched unit compiles successfully in FullDebugMode with Delphi 4, Delphi 7, Delphi 2007, and Delphi XE2.
Fix
Reject a negative or unsafe size before adding FullDebugBlockOverhead. Apply the same guard before the reallocation comparison so short-circuit evaluation prevents the unsafe addition:
if (ASize < 0) or
(ASize > (High(NativeInt) - NativeInt(FullDebugBlockOverhead))) then
Result := nil
else
Result := FastGetMem(ASize + FullDebugBlockOverhead);
Upstream applied the two guards directly in commit b09f74b32f6a5c6668a7baf3fcf67097f8007f84 . Pull request #103 was therefore closed without merge. Users of the latest published release, 4.993, should apply commit b09f74b or avoid distributing applications with FullDebugMode until a patched upstream release is available.
FastMM4-AVX Is Also Affected
FastMM4-AVX inherited the same defect. Releases through v1.0.13 are affected. The fork was fixed in commit b8a22bade6c2b0cb8153a58ad1c4f3e38b19b1dd and released as FastMM4-AVX v1.0.14 . See the FastMM4-AVX advisory for its detailed measurements and regression coverage.
Workarounds
- Do not distribute applications compiled with
FullDebugMode. - Reject unreasonable allocation sizes at application boundaries.
- Enable arithmetic checking to turn some overflow cases into an immediate failure. Arithmetic checking does not remove the defect.
Timeline
| August 15, 2026 | The inherited defect was identified while testing FastMM4-AVX |
|---|---|
| August 16, 2026 | FastMM4-AVX fixed the defect in commit b8a22ba and released v1.0.14 |
| August 16, 2026 | Upstream pull request #103 and issue #104 filed |
| August 16, 2026 | Developer advisory published at masiutin.net |
| August 20, 2026 | Upstream fix commit b09f74b applied directly to master; pull request #103 closed without merge and issue #104 closed as completed |
References
- FastMM4 issue #104: Security: FullDebugMode allocation size overflow
- FastMM4 pull request #103: Prevent FullDebugMode allocation size overflow
- Applied FastMM4 fix commit b09f74b
- Original FastMM4 repository
- GitHub Security Advisory GHSA-p7fj-xpgj-24qm
- FastMM4-AVX fix commit b8a22ba
- FastMM4-AVX developer advisory
- CWE-190: Integer Overflow or Wraparound
- CWE-680: Integer Overflow to Buffer Overflow
- CWE-787: Out-of-bounds Write
Credit
Found and remediated by Maxim Masiutin while testing FastMM4-AVX. The original FastMM4 defect was reported in issue #104 with the proposed fix in pull request #103; Pierre le Riche applied the guards directly to upstream master in commit b09f74b.