Skip to content

Commit 6ec16c4

Browse files
committed
Fix freesuffix corruption.
When attempting to grow the freesuffix storage, the realloc is sized to the number of bytes in freesuffixtotal instead of a number of pointers of that size. That is, the original malloc is for sizeof(char *) * freesuffixtotal but the realloc for growth was freesuffixtotal * 2 On a 32-bit machine, this would have the effect of freeing half of the freelist when an attempt was made to grow it. The realloc is now consistent with the initial malloc.
1 parent 7391190 commit 6ec16c4

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

memcached.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -593,7 +593,8 @@ bool do_suffix_add_to_freelist(char *s) {
593593
return false;
594594
} else {
595595
/* try to enlarge free connections array */
596-
char **new_freesuffix = realloc(freesuffix, freesuffixtotal * 2);
596+
char **new_freesuffix = realloc(freesuffix,
597+
sizeof(char *) * freesuffixtotal * 2);
597598
if (new_freesuffix) {
598599
freesuffixtotal *= 2;
599600
freesuffix = new_freesuffix;

0 commit comments

Comments
 (0)