Skip to content

Commit

Permalink
Merge pull request #10355 from BrzVlad/fix-sgen-string
Browse files Browse the repository at this point in the history
[sgen] Fix string size inconsistency between alloc/scan

This could lead to crashes when having strings with size at the LOS boundary.

#10309



<!--
Thank you for your Pull Request!

If you are new to contributing to Mono, please try to do your best at conforming to our coding guidelines http://www.mono-project.com/community/contributing/coding-guidelines/ but don't worry if you get something wrong. One of the project members will help you to get things landed.

Does your pull request fix any of the existing issues? Please use the following format: Fixes #issue-number
-->
  • Loading branch information
monojenkins committed Aug 30, 2018
2 parents bab9779 + 16fa2e9 commit 609f653
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 3 deletions.
2 changes: 2 additions & 0 deletions mono/metadata/object-internals.h
Expand Up @@ -153,6 +153,8 @@ struct _MonoString {
mono_unichar2 chars [MONO_ZERO_LEN_ARRAY];
};

#define MONO_SIZEOF_MONO_STRING (MONO_STRUCT_OFFSET (MonoString, chars))

#define mono_object_class(obj) (((MonoObject*)(obj))->vtable->klass)
#define mono_object_domain(obj) (((MonoObject*)(obj))->vtable->domain)

Expand Down
4 changes: 2 additions & 2 deletions mono/metadata/object.c
Expand Up @@ -6997,7 +6997,7 @@ mono_object_get_size (MonoObject* o)

MonoClass* klass = mono_object_class (o);
if (klass == mono_defaults.string_class) {
return sizeof (MonoString) + 2 * mono_string_length ((MonoString*) o) + 2;
return MONO_SIZEOF_MONO_STRING + 2 * mono_string_length ((MonoString*) o) + 2;
} else if (o->vtable->rank) {
MonoArray *array = (MonoArray*)o;
size_t size = MONO_SIZEOF_MONO_ARRAY + mono_array_element_size (klass) * mono_array_length (array);
Expand Down Expand Up @@ -7240,7 +7240,7 @@ mono_string_get_pinned (MonoString *str, MonoError *error)
return str;
int size;
MonoString *news;
size = sizeof (MonoString) + 2 * (mono_string_length (str) + 1);
size = MONO_SIZEOF_MONO_STRING + 2 * (mono_string_length (str) + 1);
news = (MonoString *)mono_gc_alloc_pinned_obj (((MonoObject*)str)->vtable, size);
if (news) {
memcpy (mono_string_chars (news), mono_string_chars (str), mono_string_length (str) * 2);
Expand Down
2 changes: 1 addition & 1 deletion mono/metadata/sgen-client-mono.h
Expand Up @@ -115,7 +115,7 @@ sgen_client_slow_object_get_size (GCVTable vtable, GCObject* o)
* mono_array_length_fast not using the object's vtable.
*/
if (klass == mono_defaults.string_class) {
return G_STRUCT_OFFSET (MonoString, chars) + 2 * mono_string_length_fast ((MonoString*) o) + 2;
return MONO_SIZEOF_MONO_STRING + 2 * mono_string_length_fast ((MonoString*) o) + 2;
} else if (m_class_get_rank (klass)) {
return sgen_mono_array_size (vtable, (MonoArray*)o, NULL, 0);
} else {
Expand Down

0 comments on commit 609f653

Please sign in to comment.