resolv: use proper bound in __gai_freemem
Checks
Context |
Check |
Description |
redhat-pt-bot/TryBot-apply_patch |
success
|
Patch applied to master at the time it was sent
|
redhat-pt-bot/TryBot-32bit |
success
|
Build for i686
|
linaro-tcwg-bot/tcwg_glibc_build--master-arm |
success
|
Testing passed
|
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 |
success
|
Testing passed
|
linaro-tcwg-bot/tcwg_glibc_check--master-arm |
success
|
Testing passed
|
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 |
success
|
Testing passed
|
Commit Message
__gai_freemem participates in the __libc_freeres mechanism to clean up
things at exit when requested by debugging/heap-checking tools such as
valgrind
The "pool" in gai_misc.c has valid data over the range [0, pool_size),
but the allocation stretches as far as pool_max_size. The elements
between pool_size and pool_max_size are uninitialized - so, use
pool_size as the iteration limit when free'ing data from pool, not
pool_max_size.
---
resolv/gai_misc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
* Peter Edwards via Libc-alpha:
> __gai_freemem participates in the __libc_freeres mechanism to clean up
> things at exit when requested by debugging/heap-checking tools such as
> valgrind
>
> The "pool" in gai_misc.c has valid data over the range [0, pool_size),
> but the allocation stretches as far as pool_max_size. The elements
> between pool_size and pool_max_size are uninitialized - so, use
> pool_size as the iteration limit when free'ing data from pool, not
> pool_max_size.
> ---
> resolv/gai_misc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/resolv/gai_misc.c b/resolv/gai_misc.c
> index 9e3b1d29b7..0c0ae741f9 100644
> --- a/resolv/gai_misc.c
> +++ b/resolv/gai_misc.c
> @@ -442,7 +442,7 @@ __gai_freemem (void)
> {
> size_t row;
>
> - for (row = 0; row < pool_max_size; ++row)
> + for (row = 0; row < pool_size; ++row)
> free (pool[row]);
>
> free (pool);
Would you please re-post this with Signed-off-by:? Patch itself looks
good.
Thanks,
Florian
@@ -442,7 +442,7 @@ __gai_freemem (void)
{
size_t row;
- for (row = 0; row < pool_max_size; ++row)
+ for (row = 0; row < pool_size; ++row)
free (pool[row]);
free (pool);