提交 94d730d9 编写于 作者: X xy0 提交者: LINGuanRen

two overrun bug in ev.c & easy_mem_slab.c

上级 0dfdfca1
...@@ -1274,8 +1274,8 @@ EV_CPP(extern "C" { ...@@ -1274,8 +1274,8 @@ EV_CPP(extern "C" {
#endif #endif
WL head; WL head;
} ANSIG; } ANSIG;
//whitescan for safety hole check
static ANSIG signals [EV_NSIG - 1]; static ANSIG signals [EV_NSIG];
/*****************************************************************************/ /*****************************************************************************/
......
...@@ -278,8 +278,9 @@ static void* easy_mem_cache_grow(easy_mem_cache_t* cache) ...@@ -278,8 +278,9 @@ static void* easy_mem_cache_grow(easy_mem_cache_t* cache)
for (i = 0; i < cache->num; i++) { for (i = 0; i < cache->num; i++) {
slab->next_pos[i] = i + 1; slab->next_pos[i] = i + 1;
} }
// for static safty hole check, i is uint32_t
slab->next_pos[i - 1] = EASY_MEM_POS_END; // when i-1,i=0->0-1=unsigned(-1),convert -1 to unsigned as result may overflow
if(i>0) slab->next_pos[i - 1] = EASY_MEM_POS_END;
cache->free_objects += cache->num; cache->free_objects += cache->num;
obj = easy_mem_slab_get_obj(cache, slab); obj = easy_mem_slab_get_obj(cache, slab);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册