From f95fca39beaf5314f7af259831690974b6d1e515 Mon Sep 17 00:00:00 2001
From: ashahin <ashahin.work@gmail.com>
Date: Thu, 2 Jul 2026 22:01:51 +0000
Subject: [PATCH] fix 32-bit overflow in mi_page_start for pages over 4GB after
 their page meta info (issue #1309)

---
 include/mimalloc/internal.h | 3 ++-
 src/arena.c                 | 1 -
 test/test-api.c             | 8 +++++---
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/mimalloc/internal.h b/include/mimalloc/internal.h
index 8b3d47848..452848617 100644
--- a/include/mimalloc/internal.h
+++ b/include/mimalloc/internal.h
@@ -683,7 +683,8 @@ static inline size_t mi_page_block_size(const mi_page_t* page) {
 
 // Page start
 static inline uint8_t* mi_page_start(const mi_page_t* page) {
-  return (uint8_t*)page + (page->page_woffset * MI_SIZE_SIZE);
+  // multiplication must be done in `size_t`; in a 32-bit multiplication the offset wraps for pages whose blocks start 4 GiB or more after the page meta info
+  return (uint8_t*)page + ((size_t)page->page_woffset * MI_SIZE_SIZE);
 }
 
 static inline size_t mi_page_size(const mi_page_t* page) {
diff --git a/src/arena.c b/src/arena.c
index 0c1c94fdb..7f26ea40a 100644
--- a/src/arena.c
+++ b/src/arena.c
@@ -1608,7 +1608,6 @@ static bool mi_manage_os_memory_ex2(mi_subproc_t* subproc, void* start, size_t s
   mi_memid_t memid, mi_commit_fun_t* commit_fun, void* commit_fun_arg, mi_arena_id_t* arena_id) mi_attr_noexcept
 {
   // checks
-  mi_assert(_mi_is_aligned(start, MI_ARENA_SLICE_SIZE));
   mi_assert(start!=NULL);
   if (arena_id != NULL) { *arena_id = _mi_arena_id_none(); }
   if (start==NULL) return false;
diff --git a/test/test-api.c b/test/test-api.c
index f9733d770..7d6c6a55c 100644
--- a/test/test-api.c
+++ b/test/test-api.c
@@ -355,9 +355,11 @@ int main(void) {
     }
   }
 
-  // CHECK_BODY("arena_reserve") {
-  //   result = (0==mi_reserve_os_memory(16*MI_GiB,false,true));
-  // }
+  #if (MI_INTPTR_SIZE > 4)
+  CHECK_BODY("arena_reserve") {
+    result = (0==mi_reserve_os_memory(16*MI_GiB,false,true));
+  }
+  #endif
 
   // ---------------------------------------------------
   // Heaps