Skip to content

Commit

Permalink
Detect and throw on over-size array.
Browse files Browse the repository at this point in the history
Otherwise, the multiplication with the element size can overflow; this
leads to an allocation of zero (or a small number) of bytes, which we
then SEGV on trying to zero because they are under-length.
  • Loading branch information
jnthn committed Feb 22, 2017
1 parent 0feac41 commit b41c4e3
Showing 1 changed file with 6 additions and 2 deletions.
8 changes: 6 additions & 2 deletions src/6model/reprs/VMArray.c
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@ static MVMuint64 zero_slots(MVMThreadContext *tc, MVMArrayBody *body,
return elems;
}

static void set_size_internal(MVMThreadContext *tc, MVMArrayBody *body, MVMint64 n, MVMArrayREPRData *repr_data) {
static void set_size_internal(MVMThreadContext *tc, MVMArrayBody *body, MVMuint64 n, MVMArrayREPRData *repr_data) {
MVMuint64 elems = body->elems;
MVMuint64 start = body->start;
MVMuint64 ssize = body->ssize;
Expand Down Expand Up @@ -325,8 +325,12 @@ static void set_size_internal(MVMThreadContext *tc, MVMArrayBody *body, MVMint64
if (ssize < 8) ssize = 8;
}
else {
ssize = (n + 0x1000) & ~0xfff;
ssize = (n + 0x1000) & ~0xfffUL;
}
if (ssize > (1UL << (8 * sizeof(size_t) - repr_data->elem_size)))
MVM_exception_throw_adhoc(tc,
"Unable to allocate an array of %lu elements",
ssize);

/* now allocate the new slot buffer */
slots = (slots)
Expand Down

0 comments on commit b41c4e3

Please sign in to comment.