diff options
| author | Luc Van Oostenryck <luc.vanoostenryck@gmail.com> | 2018-03-08 04:29:00 +0100 |
|---|---|---|
| committer | Luc Van Oostenryck <luc.vanoostenryck@gmail.com> | 2018-05-06 01:37:01 +0200 |
| commit | 10d66edae8db3e5d6c92d56df08d368c22cc2d39 (patch) | |
| tree | 85630a61a630152ff1ed8708f486e5efdbe25c15 | |
| parent | eb604d16038730c791e7ab9fe4e9cbcef8fced1c (diff) | |
| download | sparse-dev-10d66edae8db3e5d6c92d56df08d368c22cc2d39.tar.gz | |
alloc: check if size is too big
The allocate functions can take an extra size in arguments
used to allocate some variable extta space at the end of the
allocated structure. In the common case this extra size is zero
and if not it should be relatively small. In all cases the total
size must be smaller than the 'chunking factor' (the size of the
block ued t do these allocations).
However, this total size is not tested and all kinds of interesting
failures can be produced if it is too big.
Fix this by adding a test and die in case of failure.
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
| -rw-r--r-- | allocate.c | 2 |
1 files changed, 2 insertions, 0 deletions
@@ -103,6 +103,8 @@ void *allocate(struct allocator_struct *desc, unsigned int size) struct allocation_blob *newblob = blob_alloc(chunking); if (!newblob) die("out of memory"); + if (size > chunking) + die("alloc too big"); desc->total_bytes += chunking; newblob->next = blob; blob = newblob; |