# HG changeset patch # User Mike Becker # Date 1734811408 -3600 # Node ID 1ecf4dbbc60c77e1a3ffdc153857dc10bc5e7964 # Parent ec62453fc8a6c77649d96a6cd2aeda8662d5867c add some more overflow treatment and make sure to set errno properly resolves #469 diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/allocator.c --- a/src/allocator.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/allocator.c Sat Dec 21 21:03:28 2024 +0100 @@ -99,7 +99,7 @@ ) { size_t n; if (cx_szmul(nmemb, size, &n)) { - errno = ENOMEM; + errno = EOVERFLOW; return 1; } else { void *nmem = realloc(*mem, n); @@ -137,7 +137,7 @@ ) { size_t n; if (cx_szmul(nmemb, size, &n)) { - errno = ENOMEM; + errno = EOVERFLOW; return NULL; } else { return allocator->cl->realloc(allocator->data, mem, n); diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/array_list.c --- a/src/array_list.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/array_list.c Sat Dec 21 21:03:28 2024 +0100 @@ -40,7 +40,12 @@ size_t elem_size, cx_attr_unused CxArrayReallocator *alloc ) { - return realloc(array, capacity * elem_size); + size_t n; + if (cx_szmul(capacity, elem_size, &n)) { + errno = EOVERFLOW; + return NULL; + } + return realloc(array, n); } CxArrayReallocator cx_array_default_reallocator_impl = { @@ -57,18 +62,25 @@ size_t elem_size, cx_attr_unused CxArrayReallocator *alloc ) { + // check for overflow + size_t n; + if (cx_szmul(capacity, elem_size, &n)) { + errno = EOVERFLOW; + return NULL; + } + // retrieve the pointer to the actual allocator const CxAllocator *al = alloc->ptr1; // check if the array is still located on the stack void *newmem; if (array == alloc->ptr2) { - newmem = cxMalloc(al, capacity * elem_size); + newmem = cxMalloc(al, n); if (newmem != NULL && array != NULL) { - memcpy(newmem, array, capacity * elem_size); + memcpy(newmem, array, n); } } else { - newmem = cxRealloc(al, array, capacity * elem_size); + newmem = cxRealloc(al, array, n); } return newmem; } @@ -89,6 +101,18 @@ // LOW LEVEL ARRAY LIST FUNCTIONS +static size_t cx_array_align_capacity( + size_t cap, + size_t alignment, + size_t max +) { + if (cap > max - alignment) { + return cap; + } else { + return cap - (cap % alignment) + alignment; + } +} + int cx_array_reserve( void **array, void *size, @@ -136,19 +160,19 @@ // assert that the array is allocated when it has capacity assert(*array != NULL || oldcap == 0); - // determine new capacity - size_t newcap = oldsize + elem_count; - // check for overflow - if (newcap > max_size) { + if (elem_count > max_size - oldsize) { errno = EOVERFLOW; return 1; } + // determine new capacity + size_t newcap = oldsize + elem_count; + // reallocate if possible if (newcap > oldcap) { // calculate new capacity (next number divisible by 16) - newcap = newcap - (newcap % 16) + 16; + newcap = cx_array_align_capacity(newcap, 16, max_size); // perform reallocation void *newmem = reallocator->realloc( @@ -229,16 +253,16 @@ // assert that the array is allocated when it has capacity assert(*target != NULL || oldcap == 0); + // check for overflow + if (index > max_size || elem_count > max_size - index) { + errno = EOVERFLOW; + return 1; + } + // check if resize is required size_t minsize = index + elem_count; size_t newsize = oldsize < minsize ? minsize : oldsize; - // check for overflow - if (newsize > max_size) { - errno = EOVERFLOW; - return 1; - } - // reallocate if possible size_t newcap = oldcap; if (newsize > oldcap) { @@ -249,7 +273,7 @@ && srcaddr < targetaddr + oldcap * elem_size; // calculate new capacity (next number divisible by 16) - newcap = newsize - (newsize % 16) + 16; + newcap = cx_array_align_capacity(newsize, 16, max_size); assert(newcap > newsize); // perform reallocation @@ -274,6 +298,7 @@ start += index * elem_size; // copy elements and set new size + // note: no overflow check here, b/c we cannot get here w/o allocation memmove(start, src, elem_count * elem_size); // if any of size or capacity changed, store them back @@ -321,13 +346,19 @@ // corner case if (elem_count == 0) return 0; + // overflow check + if (elem_count > SIZE_MAX - *size) { + errno = EOVERFLOW; + return 1; + } + // store some counts size_t old_size = *size; size_t needed_capacity = old_size + elem_count; // if we need more than we have, try a reallocation if (needed_capacity > *capacity) { - size_t new_capacity = needed_capacity - (needed_capacity % 16) + 16; + size_t new_capacity = cx_array_align_capacity(needed_capacity, 16, SIZE_MAX); void *new_mem = reallocator->realloc( *target, new_capacity, elem_size, reallocator ); diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/buffer.c --- a/src/buffer.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/buffer.c Sat Dec 21 21:03:28 2024 +0100 @@ -30,6 +30,7 @@ #include #include +#include static int buffer_copy_on_write(CxBuffer* buffer) { if (0 == (buffer->flags & CX_BUFFER_COPY_ON_WRITE)) return 0; @@ -136,6 +137,7 @@ npos += offset; if ((offset > 0 && npos < opos) || (offset < 0 && npos > opos)) { + errno = EOVERFLOW; return -1; } @@ -247,6 +249,7 @@ size_t len; size_t nitems_out = nitems; if (cx_szmul(size, nitems, &len)) { + errno = EOVERFLOW; return 0; } size_t required = buffer->pos + len; @@ -285,6 +288,7 @@ if (perform_flush) { size_t flush_max; if (cx_szmul(buffer->flush_blkmax, buffer->flush_blksize, &flush_max)) { + errno = EOVERFLOW; return 0; } size_t flush_pos = buffer->flush_func == NULL || buffer->flush_target == NULL @@ -385,6 +389,7 @@ ) { size_t len; if (cx_szmul(size, nitems, &len)) { + errno = EOVERFLOW; return 0; } if (buffer->pos + len > buffer->size) { @@ -436,6 +441,10 @@ CxBuffer *buffer, size_t shift ) { + if (buffer->size > SIZE_MAX - shift) { + errno = EOVERFLOW; + return -1; + } size_t req_capacity = buffer->size + shift; size_t movebytes; diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/cx/string.h --- a/src/cx/string.h Fri Dec 20 21:25:33 2024 +0100 +++ b/src/cx/string.h Sat Dec 21 21:03:28 2024 +0100 @@ -290,6 +290,8 @@ /** * Returns the accumulated length of all specified strings. + * + * If this sum overflows, errno is set to EOVERFLOW. * * \attention if the count argument is larger than the number of the * specified strings, the behavior is undefined. diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/hash_map.c --- a/src/hash_map.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/hash_map.c Sat Dec 21 21:03:28 2024 +0100 @@ -30,6 +30,7 @@ #include #include +#include struct cx_hash_map_element_s { /** A pointer to the next element in the current bucket. */ @@ -451,6 +452,10 @@ if (map->collection.size > ((hash_map->bucket_count * 3) >> 2)) { size_t new_bucket_count = (map->collection.size * 5) >> 1; + if (new_bucket_count < hash_map->bucket_count) { + errno = EOVERFLOW; + return 1; + } struct cx_hash_map_element_s **new_buckets = cxCalloc( map->collection.allocator, new_bucket_count, sizeof(struct cx_hash_map_element_s *) diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/json.c --- a/src/json.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/json.c Sat Dec 21 21:03:28 2024 +0100 @@ -26,14 +26,14 @@ * POSSIBILITY OF SUCH DAMAGE. */ +#include "cx/json.h" + #include #include #include #include #include -#include "cx/json.h" - /* * RFC 8259 * https://tools.ietf.org/html/rfc8259 diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/mempool.c --- a/src/mempool.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/mempool.c Sat Dec 21 21:03:28 2024 +0100 @@ -29,6 +29,7 @@ #include "cx/mempool.h" #include +#include struct cx_mempool_memory_s { /** The destructor. */ @@ -45,7 +46,13 @@ if (pool->size >= pool->capacity) { size_t newcap = pool->capacity - (pool->capacity % 16) + 16; - struct cx_mempool_memory_s **newdata = realloc(pool->data, newcap*sizeof(struct cx_mempool_memory_s*)); + size_t newmsize; + if (pool->capacity > newcap || cx_szmul(newcap, + sizeof(struct cx_mempool_memory_s*), &newmsize)) { + errno = EOVERFLOW; + return NULL; + } + struct cx_mempool_memory_s **newdata = realloc(pool->data, newmsize); if (newdata == NULL) { return NULL; } @@ -72,6 +79,7 @@ ) { size_t msz; if (cx_szmul(nelem, elsize, &msz)) { + errno = EOVERFLOW; return NULL; } void *ptr = cx_mempool_malloc(p, msz); @@ -204,6 +212,7 @@ ) { size_t poolsize; if (cx_szmul(capacity, sizeof(struct cx_mempool_memory_s*), &poolsize)) { + errno = EOVERFLOW; return NULL; } diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/string.c --- a/src/string.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/string.c Sat Dec 21 21:03:28 2024 +0100 @@ -92,6 +92,7 @@ size_t size = 0; for (size_t i = 0; i < count; i++) { cxstring str = va_arg(ap, cxstring); + if (size > SIZE_MAX - str.length) errno = EOVERFLOW; size += str.length; } va_end(ap); @@ -122,14 +123,25 @@ va_start(ap, count); // get all args and overall length + bool overflow = false; size_t slen = str.length; for (size_t i = 0; i < count; i++) { cxstring s = va_arg (ap, cxstring); strings[i] = s; + if (slen > SIZE_MAX - str.length) overflow = true; slen += s.length; } va_end(ap); + // abort in case of overflow + if (overflow) { + errno = EOVERFLOW; + if (strings != strings_stack) { + free(strings); + } + return (cxmutstr) { NULL, 0 }; + } + // reallocate or create new string char *newstr; if (str.ptr == NULL) { @@ -138,7 +150,9 @@ newstr = cxRealloc(alloc, str.ptr, slen + 1); } if (newstr == NULL) { - free(strings); + if (strings != strings_stack) { + free(strings); + } return (cxmutstr) {NULL, 0}; } str.ptr = newstr; diff -r ec62453fc8a6 -r 1ecf4dbbc60c src/tree.c --- a/src/tree.c Fri Dec 20 21:25:33 2024 +0100 +++ b/src/tree.c Sat Dec 21 21:03:28 2024 +0100 @@ -403,7 +403,7 @@ return iter->node; } -__attribute__((__nonnull__)) +cx_attr_nonnull static void cx_tree_visitor_enqueue_siblings( struct cx_tree_visitor_s *iter, void *node, ptrdiff_t loc_next) { node = tree_next(node); diff -r ec62453fc8a6 -r 1ecf4dbbc60c tests/test_allocator.c --- a/tests/test_allocator.c Fri Dec 20 21:25:33 2024 +0100 +++ b/tests/test_allocator.c Sat Dec 21 21:03:28 2024 +0100 @@ -90,7 +90,7 @@ memcpy(test, "Test", 5); CX_TEST_DO { void *fail = cxReallocArray(cxDefaultAllocator, test, SIZE_MAX/2, 4); - CX_TEST_ASSERT(errno == ENOMEM); + CX_TEST_ASSERT(errno == EOVERFLOW); CX_TEST_ASSERT(fail == NULL); CX_TEST_ASSERT(0 == strcmp(test, "Test")); } @@ -148,7 +148,7 @@ CX_TEST_DO { int ret = cxReallocateArray(cxDefaultAllocator, &test, SIZE_MAX/2, 4); CX_TEST_ASSERT(ret != 0); - CX_TEST_ASSERT(errno == ENOMEM); + CX_TEST_ASSERT(errno == EOVERFLOW); CX_TEST_ASSERT(test != NULL); CX_TEST_ASSERT(0 == strcmp(test, "Test")); } @@ -173,7 +173,7 @@ CX_TEST_DO { int ret = cx_reallocatearray(&test, SIZE_MAX/2, 4); CX_TEST_ASSERT(ret != 0); - CX_TEST_ASSERT(errno == ENOMEM); + CX_TEST_ASSERT(errno == EOVERFLOW); CX_TEST_ASSERT(test != NULL); CX_TEST_ASSERT(0 == strcmp(test, "Test")); }