RTOS/rtems
1
0
Fork 0
forked from Imagelibrary/rtems
Code Pull Requests Activity

2000-11-28 Chris Johns <ccj@acm.org>

Browse Source 
* src/heapallocate.c: Do not allow the size to overflow when
	adjusting it.  A test allocated a stack of -1 (~0). This
	actually resulted in a stack being allocated but with a
	size of 0xb. The allocator did not test the size to see if
	it rolled through 0 and so allowed the allocation to happen, the
	thread to get created. The task crashed as you would expect.
This commit is contained in:
Joel Sherrill
2000-11-28 21:47:39 +00:00
parent 11edb53f85
commit 66fedb46fe
4 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
c/src/exec/score/ChangeLog
View File

@@ -1,4 +1,13 @@
2000-11-28 Chris Johns <ccj@acm.org>
* src/heapallocate.c: Do not allow the size to overflow when
adjusting it. A test allocated a stack of -1 (~0). This
actually resulted in a stack being allocated but with a
size of 0xb. The allocator did not test the size to see if
it rolled through 0 and so allowed the allocation to happen, the
thread to get created. The task crashed as you would expect.
2000-11-02 Joel Sherrill <joel@OARcorp.com> 2000-11-02 Joel Sherrill <joel@OARcorp.com>
* include/rtems/system.h: Use proper conditional (RTEMS_POSIX_API) * include/rtems/system.h: Use proper conditional (RTEMS_POSIX_API)

8
c/src/exec/score/src/heapallocate.c
View File

@@ -44,6 +44,14 @@ void *_Heap_Allocate(
void *ptr; void *ptr;
unsigned32 offset; unsigned32 offset;
/*
* Catch the case of a user allocating close to the limit of the
* unsigned32.
*/
if ( size >= (-1 - HEAP_BLOCK_USED_OVERHEAD) )
return( NULL );
excess = size % the_heap->page_size; excess = size % the_heap->page_size;
the_size = size + the_heap->page_size + HEAP_BLOCK_USED_OVERHEAD; the_size = size + the_heap->page_size + HEAP_BLOCK_USED_OVERHEAD;

9
cpukit/score/ChangeLog
View File

@@ -1,4 +1,13 @@
2000-11-28 Chris Johns <ccj@acm.org>
* src/heapallocate.c: Do not allow the size to overflow when
adjusting it. A test allocated a stack of -1 (~0). This
actually resulted in a stack being allocated but with a
size of 0xb. The allocator did not test the size to see if
it rolled through 0 and so allowed the allocation to happen, the
thread to get created. The task crashed as you would expect.
2000-11-02 Joel Sherrill <joel@OARcorp.com> 2000-11-02 Joel Sherrill <joel@OARcorp.com>
* include/rtems/system.h: Use proper conditional (RTEMS_POSIX_API) * include/rtems/system.h: Use proper conditional (RTEMS_POSIX_API)

8
cpukit/score/src/heapallocate.c
View File

@@ -44,6 +44,14 @@ void *_Heap_Allocate(
void *ptr; void *ptr;
unsigned32 offset; unsigned32 offset;
/*
* Catch the case of a user allocating close to the limit of the
* unsigned32.
*/
if ( size >= (-1 - HEAP_BLOCK_USED_OVERHEAD) )
return( NULL );
excess = size % the_heap->page_size; excess = size % the_heap->page_size;
the_size = size + the_heap->page_size + HEAP_BLOCK_USED_OVERHEAD; the_size = size + the_heap->page_size + HEAP_BLOCK_USED_OVERHEAD;