vere: fixes buffer overflow in off-loom jam #5323
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eamsden
approved these changes
Oct 12, 2021
| *w->top = ref; | ||
|
|
||
| while ( w->top != don ) { | ||
| do { |
There was a problem hiding this comment.
I assume this is changed to do-while to avoid a branch when we know the first iteration will always happen because of fill = 1 just above?
There was a problem hiding this comment.
That's right. And we're no longer keeping pointers to both the start and end of the array, so loop condition is changed to just ( fill ).
(The on-loom version of this function is u3a_walk_fore(), which now uses an api for stack manipulation. This code had been written to try to closely match that as it was before the api was introduced. But that was overly-complicated and wrong ... See #3433 and #3490)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes a bug in the use of an explicit "stack" in the preorder noun traversal used for off-loom noun serialization (jam). The bug was a "fencepost" error in resizing the "stack" (just an array), the size was checked before incrementing instead of after as it should have been. The bug was unobservable (at least on MacOS and older versions of the linux build) due to the alignment of the allocations in question.
The implementation was a little too cute with pointer caching, and has been refactored to use the array more conventionally. This PR also fixes a (small) memory leak in the jam handle destructor.
This should unblock testing of or workarounds for #5304.