Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
erts: Fix faulty udp-buffer handling
Caused core dump with gen_udp_SUITE on halfword vm.
  • Loading branch information
sverker authored and RaimoNiskanen committed Nov 28, 2011
1 parent ccf2297 commit bc09f6a
Showing 1 changed file with 9 additions and 6 deletions.
15 changes: 9 additions & 6 deletions erts/emulator/drivers/common/inet_drv.c
Expand Up @@ -10269,6 +10269,7 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event)
int code;
void * extra = NULL;
char * ptr;
int nsz;

inet_input_count(desc, n);
udesc->i_ptr += n;
Expand All @@ -10282,26 +10283,28 @@ static int packet_inet_input(udp_descriptor* udesc, HANDLE event)
ptr = udesc->i_buf->orig_bytes + sizeof(other) - len;
sys_memcpy(ptr, abuf, len);

nsz = udesc->i_ptr - ptr;

/* Check if we need to reallocate binary */
if ((desc->mode == INET_MODE_BINARY) &&
(desc->hsz < (udesc->i_ptr - ptr)) &&
((udesc->i_ptr - ptr) + BIN_REALLOC_MARGIN(desc->bufsz) >=
udesc->i_bufsz)) {
if ((desc->mode == INET_MODE_BINARY)
&& (desc->hsz < (nsz - len))
&& (nsz + BIN_REALLOC_MARGIN(desc->bufsz) < udesc->i_bufsz)) {
ErlDrvBinary* tmp;
int bufsz;
bufsz = udesc->i_ptr - udesc->i_buf->orig_bytes;
if ((tmp = realloc_buffer(udesc->i_buf, bufsz)) != NULL) {
udesc->i_buf = tmp;
udesc->i_bufsz = bufsz;
udesc->i_ptr = NULL; /* not used from here */
}
}
#ifdef HAVE_SCTP
if (IS_SCTP(desc)) extra = &mhdr;
#endif
/* Actual parsing and return of the data received, occur here: */
code = packet_reply_binary_data(desc, len, udesc->i_buf,
ptr - udesc->i_buf->orig_bytes,
udesc->i_ptr - ptr,
(sizeof(other) - len),
nsz,
extra);
free_buffer(udesc->i_buf);
udesc->i_buf = NULL;
Expand Down

0 comments on commit bc09f6a

Please sign in to comment.