Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JDK-8263558: Possible NULL dereference in fast path arena free if ZapResourceArea is true #2995

Closed
wants to merge 6 commits into from
Closed

JDK-8263558: Possible NULL dereference in fast path arena free if ZapResourceArea is true #2995

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8181b61
start
tstuefe Mar 14, 2021
aab8bbf
move check to caller; assert in AFree instead
tstuefe Mar 15, 2021
bcbe6cd
reduce diff
tstuefe Mar 15, 2021
ceaef85
just the assert
tstuefe Mar 15, 2021
21a9494
make Arealloc and Afree behave like realloc and free
tstuefe Mar 16, 2021
d401e3c
Fix minor leak on Arealloc if new_size is 0
tstuefe Mar 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/hotspot/share/memory/arena.hpp
View file
Open in desktop
Expand Up @@ -185,7 +185,9 @@ class Arena : public CHeapObj<mtNone> {
// Fast delete in area. Common case is: NOP (except for storage reclaimed)
bool Afree(void *ptr, size_t size) {
#ifdef ASSERT
if (ZapResourceArea) memset(ptr, badResourceValue, size); // zap freed memory
if (ZapResourceArea && ptr != NULL) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pointer arithmetic on line 193 is UB if ptr is nullptr (though it's unlikely anyone checks), so either Afree has ptr != nullptr as an (unstated) precondition or there are potentially more problems than the memset.

memset(ptr, badResourceValue, size); // zap freed memory
}
if (UseMallocOnly) return true;
#endif
if (((char*)ptr) + size == _hwm) {
Expand Down