fbt/sbase
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Implement reallocarray()

Browse Source 
Stateless and I stumbled upon this issue while discussing the
semantics of read, accepting a size_t but only being able to return
ssize_t, effectively lacking the ability to report successful
reads > SSIZE_MAX.
The discussion went along and we came to the topic of input-based
memory allocations. Basically, it was possible for the argument
to a memory-allocation-function to overflow, leading to a segfault
later.
The OpenBSD-guys came up with the ingenious reallocarray-function,
and I implemented it as ereallocarray, which automatically returns
on error.
Read more about it here[0].

A simple testcase is this (courtesy to stateless):
$ sbase-strings -n (2^(32|64) / 4)

This will segfault before this patch and properly return an OOM-
situation afterwards (thanks to the overflow-check in reallocarray).

[0]: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/calloc.3
This commit is contained in:
FRIGN
2015-03-10 21:16:21 +01:00
parent 066a0306a1
commit 3b825735d8
14 changed files with 84 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
find.c
View File

@@ -380,7 +380,7 @@ pri_exec(Arg *arg)
/* if we have too many files, realloc (with space for NULL termination) */
if (e->u.p.next + 1 == e->u.p.cap)
e->argv = erealloc(e->argv, (e->u.p.cap *= 2) * sizeof(*e->argv));
e->argv = ereallocarray(e->argv, e->u.p.cap *= 2, sizeof(*e->argv));
e->argv[e->u.p.next++] = estrdup(arg->path);
e->u.p.filelen += len + sizeof(arg->path);
@@ -595,7 +595,7 @@ get_exec_arg(char *argv[], Extra *extra)
e->u.p.arglen = e->u.p.filelen = 0;
e->u.p.first = e->u.p.next = arg - argv - 1;
e->u.p.cap = (arg - argv) * 2;
e->argv = emalloc(e->u.p.cap * sizeof(*e->argv));
e->argv = ereallocarray(e->argv, e->u.p.cap, sizeof(*e->argv));
for (arg = argv, new = e->argv; *arg; arg++, new++) {
*new = *arg;
@@ -604,7 +604,7 @@ get_exec_arg(char *argv[], Extra *extra)
arg++; /* due to our extra NULL */
} else {
e->argv = argv;
e->u.s.braces = emalloc(++nbraces * sizeof(*e->u.s.braces)); /* ++ for NULL */
e->u.s.braces = ereallocarray(e->u.s.braces, ++nbraces, sizeof(*e->u.s.braces)); /* ++ for NULL */
for (arg = argv, braces = e->u.s.braces; *arg; arg++)
if (!strcmp(*arg, "{}"))
@@ -632,7 +632,7 @@ get_ok_arg(char *argv[], Extra *extra)
*arg = NULL;
o->argv = argv;
o->braces = emalloc(++nbraces * sizeof(*o->braces));
o->braces = ereallocarray(o->braces, ++nbraces, sizeof(*o->braces));
for (arg = argv, braces = o->braces; *arg; arg++)
if (!strcmp(*arg, "{}"))
@@ -824,7 +824,7 @@ parse(int argc, char **argv)
* https://en.wikipedia.org/wiki/Shunting-yard_algorithm
* read from infix, resulting rpn ends up in rpn, next position in rpn is out
* push operators onto stack, next position in stack is top */
rpn = emalloc((ntok + gflags.print) * sizeof(*rpn));
rpn = ereallocarray(rpn, ntok + gflags.print, sizeof(*rpn));
for (tok = infix, out = rpn, top = stack; tok->type != END; tok++) {
switch (tok->type) {
case PRIM: *out++ = *tok; break;