Skip to content

Commit

Permalink
mem: safety prev free checks for f_malloc extract operation
Browse files Browse the repository at this point in the history
- following a report by Alex Balashov

(cherry picked from commit a620bfe)
  • Loading branch information
miconda committed Sep 8, 2015
1 parent 9d6e5aa commit de7eb56
Showing 1 changed file with 23 additions and 0 deletions.
23 changes: 23 additions & 0 deletions mem/f_malloc.c
Expand Up @@ -179,6 +179,29 @@ static inline void fm_extract_free(struct fm_block* qm, struct fm_frag* frag)
pf = frag->prv_free;
hash = GET_HASH(frag->size);

if(unlikely(pf==0)) {
/* try to discover previous fragment (safety review) */
LM_WARN("missing prev info for fragment %p from %p [%d]\n",
frag, qm, hash);
if(likely(qm->free_hash[hash].first)) {
if(likely(qm->free_hash[hash].first==frag)) {
pf = &(qm->free_hash[hash].first);
} else {
for(pf=&(qm->free_hash[hash].first); (*pf); pf=&((*pf)->u.nxt_free)) {
if((*pf)->u.nxt_free==frag) {
break;
}
}
}
}
if(unlikely(pf==0)) {
LM_ALERT("attemting to extract inexistent fragment %p from %p [%d]\n",
frag, qm, hash);
return;
}
frag->prv_free = pf;
}

*pf=frag->u.nxt_free;

if(frag->u.nxt_free) frag->u.nxt_free->prv_free = pf;
Expand Down

0 comments on commit de7eb56

Please sign in to comment.