FastMM4 Allocation Size Overflow in FullDebugMode

Developer security advisory. Issue #104. Published: August 16, 2026. Fixed on upstream master in commit b09f74b; not yet released.

Summary

When FastMM4 is compiled with FullDebugMode, adding the debug-block overhead to a near-maximum allocation size can overflow. The wrapped value can cause the underlying allocator to return a block much smaller than requested. FastMM4 then uses the original size to locate the debug footer and can write it outside the allocation before returning.

DebugReallocMem contains the same unsafe addition in its in-place size test. Builds without FullDebugMode are not affected by this defect.

Severity: Medium (CVSS 4.0 Score: 5.8). No CVE has been assigned.

Vulnerability Details

Issue FastMM4 issue #104
Related Advisory GHSA-p7fj-xpgj-24qm , published for the inherited FastMM4-AVX defect
Pull Request FastMM4 pull request #103
Vulnerability Type Integer Overflow or Wraparound (CWE-190) and Integer Overflow to Buffer Overflow (CWE-680), leading to an Out-of-bounds Write (CWE-787)
Product FastMM4 Memory Manager
Affected Component DebugGetMem and DebugReallocMem in FastMM4.pas, reached only in FullDebugMode
Affected Versions FastMM4 4.993 and earlier releases. Upstream master before commit b09f74b is also affected.
Fix Status Fixed directly on upstream master in commit b09f74b . Pull request #103 was closed without merge after the maintainer applied the guards directly. Issue #104 is complete. No published upstream release contains the fix yet.
Impact Out-of-bounds footer write, allocator metadata corruption, further memory corruption, or process termination

CVSS Score

Version CVSS 4.0
Score 5.8 Medium
Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

The vector describes a local application built with FullDebugMode. No network-reachable path, confidentiality loss, or cross-system impact has been demonstrated.

Technical Details

Root Cause

DebugGetMem adds the overhead before checking whether the sum is representable:

Result := FastGetMem(ASize + FullDebugBlockOverhead);

DebugReallocMem performs the corresponding unsafe calculation in its size test:

if LBlockSpace < (NativeUInt(ANewSize) + FullDebugBlockOverhead) then

When the first sum wraps, the underlying allocator can return a small block. The footer address is then derived from the original near-maximum size and points outside that block.

Reproduction

The defect was reproduced in original FastMM4 with Delphi 7 and FullDebugMode. An allocation of High(NativeUInt) returned a pointer before the process terminated:

Attempting to allocate: $FFFFFFFF bytes (High(NativeUInt))
[FAIL] High(NativeUInt) allocation - VULNERABILITY: got pointer $7FE91940
Runtime error 204
                    

The patched unit compiles successfully in FullDebugMode with Delphi 4, Delphi 7, Delphi 2007, and Delphi XE2.

Fix

Reject a negative or unsafe size before adding FullDebugBlockOverhead. Apply the same guard before the reallocation comparison so short-circuit evaluation prevents the unsafe addition:

if (ASize < 0) or
    (ASize > (High(NativeInt) - NativeInt(FullDebugBlockOverhead))) then
  Result := nil
else
  Result := FastGetMem(ASize + FullDebugBlockOverhead);
                    

Upstream applied the two guards directly in commit b09f74b32f6a5c6668a7baf3fcf67097f8007f84 . Pull request #103 was therefore closed without merge. Users of the latest published release, 4.993, should apply commit b09f74b or avoid distributing applications with FullDebugMode until a patched upstream release is available.

FastMM4-AVX Is Also Affected

FastMM4-AVX inherited the same defect. Releases through v1.0.13 are affected. The fork was fixed in commit b8a22bade6c2b0cb8153a58ad1c4f3e38b19b1dd and released as FastMM4-AVX v1.0.14 . See the FastMM4-AVX advisory for its detailed measurements and regression coverage.

Workarounds

  • Do not distribute applications compiled with FullDebugMode.
  • Reject unreasonable allocation sizes at application boundaries.
  • Enable arithmetic checking to turn some overflow cases into an immediate failure. Arithmetic checking does not remove the defect.

Timeline

August 15, 2026 The inherited defect was identified while testing FastMM4-AVX
August 16, 2026 FastMM4-AVX fixed the defect in commit b8a22ba and released v1.0.14
August 16, 2026 Upstream pull request #103 and issue #104 filed
August 16, 2026 Developer advisory published at masiutin.net
August 20, 2026 Upstream fix commit b09f74b applied directly to master; pull request #103 closed without merge and issue #104 closed as completed

References

Credit

Found and remediated by Maxim Masiutin while testing FastMM4-AVX. The original FastMM4 defect was reported in issue #104 with the proposed fix in pull request #103; Pierre le Riche applied the guards directly to upstream master in commit b09f74b.