[PATCH 2/4] shallow.c: avoid theoretical pointer wrap-around
- From
Rasmus Villemoes <rv@rasmusvillemoes.dk>
- Date
- Dec 2, 2016, 20:31 UTC
- Message-ID
- <1480710664-26290-2-git-send-email-rv@rasmusvillemoes.dk>
- In-Reply-To
- <1480710664-26290-1-git-send-email-rv@rasmusvillemoes.dk>
The expression info->free+size is technically undefined behaviour in exactly the case we want to test for. Moreover, the compiler is likely to translate the expression to
(unsigned long)info->free + size > (unsigned long)info->end
where there's at least a theoretical chance that the LHS could wrap around 0, giving a false negative.
This might as well be written using pointer subtraction avoiding these issues.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk> --- shallow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shallow.c b/shallow.c index e21534a..8b1c35d 100644 --- a/shallow.c +++ b/shallow.c @@ -444,7 +444,7 @@ static uint32_t *paint_alloc(struct paint_info *info) unsigned nr = (info->nr_bits + 31) / 32; unsigned size = nr * sizeof(uint32_t); void *p; - if (!info->slab_count || info->free + size > info->end) { + if (!info->slab_count || size > info->end - info->free) { unsigned alloc_size = size < COMMIT_SLAB_SIZE ? COMMIT_SLAB_SIZE : size; info->slab_count++;
-- 2.1.4