From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7DC1471212; Thu, 5 Aug 2021 21:18:49 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7DC1471212 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1628187529; bh=iQIXZBVN+COF+pY9OdqT2A8HFGAS5vBIz86jtp/7ELk=; h=To:Cc:Date:In-Reply-To:References:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=AIe6fZcq9YEqsaxYZhUWKqZ7aEcNi8A6GUcN2uVYn4acin7sxPa/55ZAtUJGsW5tK 3qDxwFEB4lrKWXmlGMu+PaZbsuQlSQUaic7akywVP12wAUx+onNQ2GMTRIW68qV3Iv bdlhh6jl87kgDf0ndva0xtuJWxOhf/FxYg2+GDgQ= Received: from smtp53.i.mail.ru (smtp53.i.mail.ru [94.100.177.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 4C9A5741D6 for ; Thu, 5 Aug 2021 21:17:51 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 4C9A5741D6 Received: by smtp53.i.mail.ru with esmtpa (envelope-from ) id 1mBhwE-0005CS-6I; Thu, 05 Aug 2021 21:17:50 +0300 To: v.shpilevoy@tarantool.org, vdavydov@tarantool.org Cc: tarantool-patches@dev.tarantool.org, mechanik20051988 Date: Thu, 5 Aug 2021 21:17:40 +0300 Message-Id: <9283d4de4f1cfdc3a912d2730b8303ea7ff52b2b.1628184138.git.mechanik20.05.1988@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD92087353F0EC44DD9D5AC6413C25DCF08CC98B8FCC5CD86F3182A05F53808504005AA9F5E9178D194C699D6DDDFA5B41D5923C04D9D860F2BFF93DCA32718ED0A X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE76D24A1449B9F25A2EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637803A71E7516670C28638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D810D92D614847E73E3F1D1122B524125E117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC11A27A05CE189FECA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F44604297287769387670735207B96B19DC4093321618001F51B5FD3F9D2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EEC8105B04EFE07628E0F2381F647739FAD8FC6C240DEA7642DBF02ECDB25306B2B78CF848AE20165D0A6AB1C7CE11FEE30085B890FD2717DAC0837EA9F3D19764C4224003CC836476EA7A3FFF5B025636E2021AF6380DFAD1A18204E546F3947CB11811A4A51E3B096D1867E19FE1407959CC434672EE6371089D37D7C0E48F6C8AA50765F790063780E7E366B0FF8F58EFF80C71ABB335746BA297DBC24807EABDAD6C7F3747799A X-C1DE0DAB: C20DE7B7AB408E4181F030C43753B8186998911F362727C414F749A5E30D975C30CE973C7F71088D389F09A950265B554C2E6B24DDA03D9B9C2B6934AE262D3EE7EAB7254005DCED7532B743992DF240BDC6A1CF3F042BAD6DF99611D93F60EF3033054805BDE987699F904B3F4130E343918A1A30D5E7FCCB5012B2E24CD356 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34980A6B448CFD1B8A7E5C8D0167BF60CC8D17EAABFA27468B94572E1DC07811C16B5F9D00C108CC581D7E09C32AA3244CFF0C0DBA27B9286F13522866C2C4FFA881560E2432555DBB927AC6DF5659F194 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojh4v93/7HD3WuENLdpdwtfA== X-Mailru-Sender: 583F1D7ACE8F49BD29FC049B2A5BF963272C3B768E89E9F19BAD4FFA1A30E74707FD25DC8DE6ABBEB79567116EAC6FCF4E830D9205DBEA545646F0D3C63A617F27ACC94E9A535D22112434F685709FCF0DA7A0AF5A3A8387 X-Mras: Ok Subject: [Tarantool-patches] [PATCH 2/7] salad: fix segfault in case when mhash table allocation failure X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: mechanik20051988 via Tarantool-patches Reply-To: mechanik20051988 Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: mechanik20051988 There was no check for successful memory allocation in `new` and `clear` functions for mhash table. And if the memory was not allocated, a null pointer dereference occured. --- src/lib/salad/mhash.h | 99 +++++++++++++++++++++++++++--------------- test/unit/mhash_body.c | 4 +- 2 files changed, 66 insertions(+), 37 deletions(-) diff --git a/src/lib/salad/mhash.h b/src/lib/salad/mhash.h index b555cad4c..74235eeaa 100644 --- a/src/lib/salad/mhash.h +++ b/src/lib/salad/mhash.h @@ -157,7 +157,7 @@ struct _mh(t) { #define MH_DENSITY 0.7 struct _mh(t) * _mh(new)(); -void _mh(clear)(struct _mh(t) *h); +int _mh(clear)(struct _mh(t) *h); void _mh(delete)(struct _mh(t) *h); void _mh(resize)(struct _mh(t) *h, mh_arg_t arg); int _mh(start_resize)(struct _mh(t) *h, mh_int_t buckets, mh_int_t batch, @@ -399,23 +399,50 @@ _mh(del_resize)(struct _mh(t) *h, mh_int_t x, struct _mh(t) * _mh(new)() { - struct _mh(t) *h = (struct _mh(t) *) calloc(1, sizeof(*h)); - h->shadow = (struct _mh(t) *) calloc(1, sizeof(*h)); + struct _mh(t) *h = (struct _mh(t) *)calloc(1, sizeof(*h)); + if (h == NULL) + return NULL; + h->shadow = (struct _mh(t) *)calloc(1, sizeof(*h)); + if (h->shadow == NULL) + goto fail; h->prime = 0; h->n_buckets = __ac_prime_list[h->prime]; - h->p = (mh_node_t *) calloc(h->n_buckets, sizeof(mh_node_t)); + h->p = (mh_node_t *)calloc(h->n_buckets, sizeof(mh_node_t)); + if (h->p == NULL) + goto fail; #if !mh_bytemap - h->b = (uint32_t *) calloc(h->n_buckets / 16 + 1, sizeof(uint32_t)); + h->b = (uint32_t *)calloc(h->n_buckets / 16 + 1, sizeof(uint32_t)); #else - h->b = (uint8_t *) calloc(h->n_buckets, sizeof(uint8_t)); + h->b = (uint8_t *)calloc(h->n_buckets, sizeof(uint8_t)); #endif + if (h->b == NULL) + goto fail; h->upper_bound = h->n_buckets * MH_DENSITY; return h; + +fail: + free(h->p); + free(h->shadow); + free(h); + return NULL; } -void +int _mh(clear)(struct _mh(t) *h) { + mh_int_t n_buckets = __ac_prime_list[h->prime]; + mh_node_t *p = (mh_node_t *)calloc(n_buckets, sizeof(mh_node_t)); + if (p == NULL) + return -1; +#if !mh_bytemap + uint32_t *b = (uint32_t *)calloc(n_buckets / 16 + 1, sizeof(uint32_t)); +#else + uint8_t *b = (uint8_t *)calloc(n_buckets, sizeof(uint8_t)); +#endif + if (b == NULL) { + free(p); + return -1; + } if (h->shadow->p) { free(h->shadow->p); free(h->shadow->b); @@ -424,15 +451,12 @@ _mh(clear)(struct _mh(t) *h) free(h->p); free(h->b); h->prime = 0; - h->n_buckets = __ac_prime_list[h->prime]; - h->p = (mh_node_t *) calloc(h->n_buckets, sizeof(mh_node_t)); -#if !mh_bytemap - h->b = (uint32_t *) calloc(h->n_buckets / 16 + 1, sizeof(uint32_t)); -#else - h->b = (uint8_t *) calloc(h->n_buckets, sizeof(uint8_t)); -#endif + h->n_buckets = n_buckets; + h->p = p; + h->b = b; h->size = 0; h->upper_bound = h->n_buckets * MH_DENSITY; + return 0; } void @@ -515,42 +539,47 @@ _mh(start_resize)(struct _mh(t) *h, mh_int_t buckets, mh_int_t batch, /* hash size is already greater than requested */ return 0; } - while (h->prime < __ac_HASH_PRIME_SIZE - 1) { - if (__ac_prime_list[h->prime] >= buckets) + mh_int_t new_prime = h->prime; + while (new_prime < __ac_HASH_PRIME_SIZE - 1) { + if (__ac_prime_list[new_prime] >= buckets) break; - h->prime += 1; + new_prime += 1; } - - h->batch = batch > 0 ? batch : h->n_buckets / (256 * 1024); - if (h->batch < 256) { + mh_int_t new_batch = batch > 0 ? batch : h->n_buckets / (256 * 1024); + if (new_batch < 256) { /* * Minimal batch must be greater or equal to * 1 / (1 - f), where f is upper bound percent * = MH_DENSITY */ - h->batch = 256; + new_batch = 256; } - struct _mh(t) *s = h->shadow; - memcpy(s, h, sizeof(*h)); - s->resize_position = 0; - s->n_buckets = __ac_prime_list[h->prime]; - s->upper_bound = s->n_buckets * MH_DENSITY; - s->n_dirty = 0; - s->size = 0; - s->p = (mh_node_t *) malloc(s->n_buckets * sizeof(mh_node_t)); - if (s->p == NULL) + mh_int_t n_buckets = __ac_prime_list[new_prime]; + mh_node_t *p = (mh_node_t *)malloc(n_buckets * sizeof(mh_node_t)); + if (p == NULL) return -1; #if !mh_bytemap - s->b = (uint32_t *) calloc(s->n_buckets / 16 + 1, sizeof(uint32_t)); + uint32_t *b = (uint32_t *)calloc(n_buckets / 16 + 1, sizeof(uint32_t)); #else - s->b = (uint8_t *) calloc(s->n_buckets, sizeof(uint8_t)); + uint8_t *b = (uint8_t *)calloc(n_buckets, sizeof(uint8_t)); #endif - if (s->b == NULL) { - free(s->p); - s->p = NULL; + if (b == NULL) { + free(p); return -1; } + + h->prime = new_prime; + h->batch = new_batch; + struct _mh(t) *s = h->shadow; + memcpy(s, h, sizeof(*h)); + s->resize_position = 0; + s->n_buckets = n_buckets; + s->upper_bound = s->n_buckets * MH_DENSITY; + s->n_dirty = 0; + s->size = 0; + s->p = p; + s->b = b; _mh(resize)(h, arg); return 0; diff --git a/test/unit/mhash_body.c b/test/unit/mhash_body.c index 458817fb1..324c72a43 100644 --- a/test/unit/mhash_body.c +++ b/test/unit/mhash_body.c @@ -23,7 +23,7 @@ h = init(); destroy(h); h = init(); -clear(h); +fail_unless(clear(h) == 0); /* access not yet initialized hash */ clr(9); @@ -59,7 +59,7 @@ tst(7); tst(8); tst(9); -clear(h); +fail_unless(clear(h) == 0); /* after clear no items should exist */ clr(1); -- 2.20.1