From: Rasmus Villemoes Date: Fri, 02 Dec 2016 20:31:02 GMT Subject: [PATCH 2/4] shallow.c: avoid theoretical pointer wrap-around Message-ID: <1480710664-26290-2-git-send-email-rv@rasmusvillemoes.dk> In-Reply-To: <1480710664-26290-1-git-send-email-rv@rasmusvillemoes.dk> The expression info->free+size is technically undefined behaviour in exactly the case we want to test for. Moreover, the compiler is likely to translate the expression to (unsigned long)info->free + size > (unsigned long)info->end where there's at least a theoretical chance that the LHS could wrap around 0, giving a false negative. This might as well be written using pointer subtraction avoiding these issues. Signed-off-by: Rasmus Villemoes --- shallow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shallow.c b/shallow.c index e21534a..8b1c35d 100644 --- a/shallow.c +++ b/shallow.c @@ -444,7 +444,7 @@ static uint32_t *paint_alloc(struct paint_info *info) unsigned nr = (info->nr_bits + 31) / 32; unsigned size = nr * sizeof(uint32_t); void *p; - if (!info->slab_count || info->free + size > info->end) { + if (!info->slab_count || size > info->end - info->free) { unsigned alloc_size = size < COMMIT_SLAB_SIZE ? COMMIT_SLAB_SIZE : size; info->slab_count++; -- 2.1.4