mirror of
https://git.savannah.gnu.org/git/guile.git
synced 2025-05-02 13:00:26 +02:00
Correct reference to dangling pointer and better note bounds checking
lib/jit_note.c: Correct bounds check and wrong code keeping a pointer that could be changed after a realloc call.
This commit is contained in:
parent
9e86ef12cf
commit
2da31e82fa
2 changed files with 7 additions and 2 deletions
|
@ -1,3 +1,8 @@
|
||||||
|
2013-01-18 Paulo Andrade <pcpa@gnu.org>
|
||||||
|
|
||||||
|
lib/jit_note.c: Correct bounds check and wrong code keeping
|
||||||
|
a pointer that could be changed after a realloc call.
|
||||||
|
|
||||||
2013-01-18 Paulo Andrade <pcpa@gnu.org>
|
2013-01-18 Paulo Andrade <pcpa@gnu.org>
|
||||||
|
|
||||||
* check/3to2.tst, check/add.tst, check/allocai.tst, check/bp.tst,
|
* check/3to2.tst, check/add.tst, check/allocai.tst, check/bp.tst,
|
||||||
|
|
|
@ -195,10 +195,10 @@ _new_note(jit_state_t *_jit, jit_uint8_t *code, char *name)
|
||||||
_jit->note.ptr = malloc(sizeof(jit_note_t) * 8);
|
_jit->note.ptr = malloc(sizeof(jit_note_t) * 8);
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
prev = _jit->note.ptr + _jit->note.length - 1;
|
|
||||||
if ((_jit->note.length & 7) == 7)
|
if ((_jit->note.length & 7) == 7)
|
||||||
_jit->note.ptr = realloc(_jit->note.ptr, sizeof(jit_note_t) *
|
_jit->note.ptr = realloc(_jit->note.ptr, sizeof(jit_note_t) *
|
||||||
(_jit->note.length + 9));
|
(_jit->note.length + 9));
|
||||||
|
prev = _jit->note.ptr + _jit->note.length - 1;
|
||||||
}
|
}
|
||||||
if (prev) {
|
if (prev) {
|
||||||
assert(code >= prev->code);
|
assert(code >= prev->code);
|
||||||
|
@ -255,7 +255,7 @@ _note_search_index(jit_state_t *_jit, jit_uint8_t *code)
|
||||||
if (code < notes[index].code)
|
if (code < notes[index].code)
|
||||||
top = index;
|
top = index;
|
||||||
else if (code >= notes[index].code &&
|
else if (code >= notes[index].code &&
|
||||||
code - notes[index].code <= notes[index].size)
|
code - notes[index].code < notes[index].size)
|
||||||
break;
|
break;
|
||||||
else
|
else
|
||||||
bot = index + 1;
|
bot = index + 1;
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue