5:13 p.m.
Allocate ret only after checking size parameter.
---
ell/uintset.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ell/uintset.c b/ell/uintset.c
index 3d9c8e3..4547ac9 100644
--- a/ell/uintset.c
+++ b/ell/uintset.c
@@ -149,12 +149,13 @@ struct l_uintset {
LIB_EXPORT struct l_uintset *l_uintset_new_from_range(uint32_t min,
uint32_t max)
{
- struct l_uintset *ret = l_new(struct l_uintset, 1);
+ struct l_uintset *ret;
unsigned int size = max - min + 1;
if (size > USHRT_MAX)
return NULL;
+ ret = l_new(struct l_uintset, 1);
ret->bits = l_new(unsigned long,
(size + BITS_PER_LONG - 1) / BITS_PER_LONG);
ret->size = size;
--
2.6.2
5:13 p.m.
New subject: [PATCH 2/4] ringbuf: Remove dead code
l_malloc cannot fail if size>0.
---
ell/ringbuf.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/ell/ringbuf.c b/ell/ringbuf.c
index 9049618..4f1f280 100644
--- a/ell/ringbuf.c
+++ b/ell/ringbuf.c
@@ -93,14 +93,7 @@ LIB_EXPORT struct l_ringbuf *l_ringbuf_new(size_t size)
real_size = align_power2(size);
ringbuf = l_new(struct l_ringbuf, 1);
- if (!ringbuf)
- return NULL;
-
ringbuf->buffer = l_malloc(real_size);
- if (!ringbuf->buffer) {
- l_free(ringbuf);
- return NULL;
- }
ringbuf->size = real_size;
ringbuf->in = RINGBUF_RESET;
--
2.6.2
5:13 p.m.
New subject: [PATCH 3/4] unit: Add tests for NULL set in uintset
---
unit/test-uintset.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/unit/test-uintset.c b/unit/test-uintset.c
index 7e17113..8d83a2a 100644
--- a/unit/test-uintset.c
+++ b/unit/test-uintset.c
@@ -25,6 +25,7 @@
#endif
#include <assert.h>
+#include <limits.h>
#include <ell/ell.h>
@@ -34,6 +35,10 @@ static void test_uintset(const void *data)
int i;
bool r;
+ assert(l_uintset_get_min(NULL) == UINT_MAX);
+ assert(l_uintset_find_max(NULL) == UINT_MAX);
+ assert(l_uintset_find_min(NULL) == UINT_MAX);
+
set = l_uintset_new_from_range(1, 76);
assert(set);
--
2.6.2
5:13 p.m.
New subject: [PATCH 4/4] uintset: Fix crash on NULL set
This fix NULL pointer dereferences in l_uintset_find_* functions.
With NULL set it is impossible to return l_uintset_get_max(set) + 1
without ambiguous return value. Return UINT_MAX for such cases.
---
ell/uintset.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/ell/uintset.c b/ell/uintset.c
index 4547ac9..e3d7ede 100644
--- a/ell/uintset.c
+++ b/ell/uintset.c
@@ -314,14 +314,15 @@ LIB_EXPORT uint32_t l_uintset_get_max(struct l_uintset *set)
* @set: The set of numbers
*
* Returns: The minimum number that is not preset in the set. If the set of
- * numbers is fully populated, returns l_uintset_get_max(set) + 1.
+ * numbers is fully populated, returns l_uintset_get_max(set) + 1. If @set is
+ * NULL returns UINT_MAX.
**/
LIB_EXPORT uint32_t l_uintset_find_unused_min(struct l_uintset *set)
{
unsigned int bit;
if (unlikely(!set))
- return set->max + 1;
+ return UINT_MAX;
bit = find_first_zero_bit(set->bits, set->size);
@@ -336,14 +337,14 @@ LIB_EXPORT uint32_t l_uintset_find_unused_min(struct l_uintset
*set)
* @set: The set of numbers
*
* Returns: The maximum number preset in the set. If the set of numbers is
- * empty, or on error, returns l_uintset_get_max(set) + 1.
+ * empty returns l_uintset_get_max(set) + 1. If @set is NULL returns UINT_MAX.
**/
LIB_EXPORT uint32_t l_uintset_find_max(struct l_uintset *set)
{
unsigned int bit;
if (unlikely(!set))
- return set->max + 1;
+ return UINT_MAX;
bit = find_last_bit(set->bits, set->size);
@@ -358,14 +359,14 @@ LIB_EXPORT uint32_t l_uintset_find_max(struct l_uintset *set)
* @set: The set of numbers
*
* Returns: The minimum number preset in the set. If the set of numbers is
- * empty, or on error, returns l_uintset_get_max(set) + 1.
+ * empty returns l_uintset_get_max(set) + 1. If @set is NULL returns UINT_MAX.
**/
LIB_EXPORT uint32_t l_uintset_find_min(struct l_uintset *set)
{
unsigned int bit;
if (unlikely(!set))
- return set->max + 1;
+ return UINT_MAX;
bit = find_first_bit(set->bits, set->size);
--
2.6.2
1954
days inactive
1954
days old
4 comments
2 participants
participants (2)
-
Denis Kenzior -
Szymon Janc