Skip to content
This repository was archived by the owner on Sep 2, 2022. It is now read-only.

Commit 426cb6a

Browse files
author
Harold Seigel
committed
8263558: Possible NULL dereference in fast path arena free if ZapResourceArea is true
Backport-of: d2c137d408b9c44f8f8d71e62dfea24a4279300e
1 parent 27c8449 commit 426cb6a

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

src/hotspot/share/memory/arena.cpp

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,14 @@ void* Arena::grow(size_t x, AllocFailType alloc_failmode) {
373373

374374
// Reallocate storage in Arena.
375375
void *Arena::Arealloc(void* old_ptr, size_t old_size, size_t new_size, AllocFailType alloc_failmode) {
376-
if (new_size == 0) return NULL;
376+
if (new_size == 0) {
377+
Afree(old_ptr, old_size); // like realloc(3)
378+
return NULL;
379+
}
380+
if (old_ptr == NULL) {
381+
assert(old_size == 0, "sanity");
382+
return Amalloc(new_size, alloc_failmode); // as with realloc(3), a NULL old ptr is equivalent to malloc(3)
383+
}
377384
#ifdef ASSERT
378385
if (UseMallocOnly) {
379386
// always allocate a new object (otherwise we'll free this one twice)

src/hotspot/share/memory/arena.hpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@ class Arena : public CHeapObj<mtNone> {
186186

187187
// Fast delete in area. Common case is: NOP (except for storage reclaimed)
188188
bool Afree(void *ptr, size_t size) {
189+
if (ptr == NULL) {
190+
return true; // as with free(3), freeing NULL is a noop.
191+
}
189192
#ifdef ASSERT
190193
if (ZapResourceArea) memset(ptr, badResourceValue, size); // zap freed memory
191194
if (UseMallocOnly) return true;

0 commit comments

Comments
 (0)