Permalink
Browse files

hash_table_lookup(): fixed race condition on return.

The item was de-referenced in the ht_return() macro after the mutex was
released, offering a window of opportunity for another thread to come in and
resize the table, corrupting the data returned.
  • Loading branch information...
1 parent 91acfc6 commit 45a2524c70d4c558f3f1dcab94198c2caad97caa @rmanfredi rmanfredi committed Apr 25, 2012
Showing with 11 additions and 1 deletion.
  1. +11 −1 src/lib/hashtable.c
View
@@ -807,25 +807,34 @@ hash_table_replace(hash_table_t *ht, const void *key, const void *value)
}
/**
+ * Lookup key in the table.
+ *
* @return value associated with the key.
*/
void *
hash_table_lookup(const hash_table_t *ht, const void *key)
{
hash_item_t *item;
+ void *p;
hash_table_check(ht);
ht_synchronize(ht);
item = hash_table_find(ht, key, NULL);
+ p = item ? deconstify_pointer(item->value) : NULL;
- ht_return(ht, item ? deconstify_pointer(item->value) : NULL);
+ ht_return(ht, p);
}
/**
* Lookup key in the hash table, returning physical pointers to the key/value
* items into ``kp'' and ``vp'' respectively, if non-NULL.
*
+ * @param ht the hash table
+ * @param key the key to lookup
+ * @param kp where the key pointer is copied, if non-NULL
+ * @param vp where the value pointer is copied, if non-NULL
+ *
* @return TRUE if item was found.
*/
bool
@@ -852,6 +861,7 @@ hash_table_lookup_extended(const hash_table_t *ht,
/**
* Check whether hashlist contains the key.
+ *
* @return TRUE if the key is present.
*/
bool

0 comments on commit 45a2524

Please sign in to comment.