devel/tbox: fix data corruption in tb_ralloc() crossing the 128 KiB mmap threshold
devel/tbox 1.8.0's tb_native_large_allocator_ralloc() corrupts data when a
reallocation crosses TB_VIRTUAL_MEMORY_DATA_MINN (128 KiB) in either
direction. In the malloc<->mmap crossover paths the block is copied with
tb_memcpy_(data, data_head, base_head->size);
The copy starts at the block header (data_head) but the length is the payload
size only. On grow, the last sizeof(tb_native_large_data_head_t) (24) bytes
of user data are silently lost; on shrink, the copy overruns the smaller
destination allocation (heap buffer overflow).
User-visible fallout: devel/xmake-io is completely broken — its Lua loader
reads script files through a tb_buffer, and for any file > 64 KiB the growth
rallocs 65536 -> 131072 across the threshold. The tail of interpreter.lua
comes back corrupted and every xmake invocation fails with a bogus
"syntax error" at the line spanning byte 65536.
Also reproduced on Linux/amd64 with a full tbox build (--small=no): identical
corruption at bytes 65512..65535. Small-mode builds are unaffected because
tb_init() selects tb_native_allocator() instead of the pooled allocator,
which is why xmake's bundled tbox never hits this path and the bug went
unnoticed upstream.
Fix: copy the header plus min(old, new) payload in both crossover paths.
Accepted upstream as https://github.com/tboox/tbox/pull/315
See also: https://github.com/tboox/tbox/pull/315
Reported by: Lin <lin@sz.cn.eu.org>
PR: 296515
MFH: 2026Q2