[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[or-cvs] check for integer overflows in more places, when adding ele...
Update of /home2/or/cvsroot/tor/src/common
In directory moria:/home/arma/work/onion/cvs/tor/src/common
Modified Files:
container.c
Log Message:
check for integer overflows in more places, when adding elements to
smartlists. this could possibly prevent a buffer overflow on malicious
huge inputs. i don't see any, but i haven't looked carefully.
Index: container.c
===================================================================
RCS file: /home2/or/cvsroot/tor/src/common/container.c,v
retrieving revision 1.56
retrieving revision 1.57
diff -u -p -d -r1.56 -r1.57
--- container.c 31 Dec 2005 06:26:10 -0000 1.56
+++ container.c 2 Jan 2006 04:40:18 -0000 1.57
@@ -79,33 +79,35 @@ smartlist_clear(smartlist_t *sl)
sl->num_used = 0;
}
-/** Append element to the end of the list. */
-void
-smartlist_add(smartlist_t *sl, void *element)
+/** Make sure that <b>sl</b> can hold at least <b>size</b> entries. */
+static INLINE void
+smartlist_ensure_capacity(smartlist_t *sl, int size)
{
- if (sl->num_used >= sl->capacity) {
+ if (size > sl->capacity) {
int higher = sl->capacity * 2;
+ while (size > higher)
+ higher *= 2;
tor_assert(higher > sl->capacity); /* detect overflow */
sl->capacity = higher;
sl->list = tor_realloc(sl->list, sizeof(void*)*sl->capacity);
}
+}
+
+/** Append element to the end of the list. */
+void
+smartlist_add(smartlist_t *sl, void *element)
+{
+ smartlist_ensure_capacity(sl, sl->num_used+1);
sl->list[sl->num_used++] = element;
}
/** Append each element from S2 to the end of S1. */
void
-smartlist_add_all(smartlist_t *sl, const smartlist_t *s2)
+smartlist_add_all(smartlist_t *s1, const smartlist_t *s2)
{
- int n2 = sl->num_used + s2->num_used;
- if (n2 > sl->capacity) {
- int higher = sl->capacity * 2;
- while (n2 > higher)
- higher *= 2;
- sl->capacity = higher;
- sl->list = tor_realloc(sl->list, sizeof(void*)*sl->capacity);
- }
- memcpy(sl->list + sl->num_used, s2->list, s2->num_used*sizeof(void*));
- sl->num_used += s2->num_used;
+ smartlist_ensure_capacity(s1, s1->num_used + s2->num_used);
+ memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*));
+ s1->num_used += s2->num_used;
}
/** Remove all elements E from sl such that E==element. Preserve
@@ -257,11 +259,7 @@ smartlist_insert(smartlist_t *sl, int id
if (idx == sl->num_used) {
smartlist_add(sl, val);
} else {
- /* Ensure sufficient capacity */
- if (sl->num_used >= sl->capacity) {
- sl->capacity *= 2;
- sl->list = tor_realloc(sl->list, sizeof(void*)*sl->capacity);
- }
+ smartlist_ensure_capacity(sl, sl->num_used+1);
/* Move other elements away */
if (idx < sl->num_used)
memmove(sl->list + idx + 1, sl->list + idx,