[PATCH v2] libstdc++: Ensure that aligned new detects size_t overflow (CVE-2026-95619)

[Jakub Jelinek]

On Wed, Sep 23, 2026 at 01:09:21PM +0100, Jonathan Wakely wrote:
> +  // The Wine msvcrt.dll version of _aligned_malloc doesn't detect overflow
> +  // so do it ourselves.
> +  std::size_t check;
> +  if (__builtin_add_overflow(sz, al + 2 * sizeof(void*), &check)) [[unlikely]]
> +    return nullptr;

If you only care about overflow and not about the value of the addition,
this could be also
  if (__builtin_add_overflow_p(sz, al + 2 * sizeof(void*), std::size_t(0))) [[unlikely]]
    return nullptr;
though it isn't supported by clang (but libsupc++ is always compiled by GCC,
right?).
Anyway, I guess al + 2 * sizeof(void*) itself won't overflow because we've
earlier checked that it has a single bit set (otherwise we'd need another
builtin to check for that overflow too).

	Jakub