8e20dbc62e
Stefan Eissing
2026-09-18
Subject
u8_strset, u32_ptrset: fix boundaries handling
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/u32_ptrset.c+5 -3
| @@ -117,18 +117,20 @@ static bool u32_ptrset_grow(struct u32_ptrset *set) | |
| uint8_t nslotbits, pslotbits; | |
| void **prev_data; | |
| size_t nslots; | |
| + | const size_t slot_size = (sizeof(void *) + (2 * sizeof(uint32_t))); |
| void *d; | |
| - | if(set->slotbits >= 32) |
| + | if(set->slotbits >= 31) |
| return FALSE; | |
| nslotbits = set->slotbits ? (uint8_t)(set->slotbits + 1) : 5; | |
| nslots = CURL_U32_SLOT_CNT(nslotbits); | |
| + | if(nslots > (SIZE_MAX / slot_size)) /* 32-bit arch may trigger here */ |
| + | return FALSE; |
| #if CURL_U32_PTRSET_DEBUG | |
| curl_mfprintf(stderr, "u32_ptrset_grow from bits=%d to %d, slots=%zu\n", | |
| set->slotbits, nslotbits, nslots); | |
| #endif | |
| - | d = curlx_calloc(1, (nslots * sizeof(void *)) + |
| - | (2 * nslots * sizeof(uint32_t))); |
| + | d = curlx_calloc(1, nslots * slot_size); |
| if(!d) | |
| return FALSE; | |
lib/u32_ptrset.h+1 -1
| @@ -27,7 +27,7 @@ | |
| typedef void Curl_u32_ptrset_dtor(uint32_t id, void *ptr); | |
| - | /* A set that can hold up UINT32_MAX pointers identified by an `id'. |
| + | /* A set that can hold up to INT32_MAX+1 pointers identified by an `id'. |
| * Setting a pointer for an existing id replaces the previous one. | |
| * Getting the pointer for an id not in the set returns NULL. | |
| * Setting an id to NULL unsets the id. | |
lib/u8_strset.c+7 -4
| @@ -117,7 +117,7 @@ static void u8_strset_addn(struct u8_strset *set, uint8_t id, char *val) | |
| static bool u8_strset_grow(struct u8_strset *set) | |
| { | |
| - | uint8_t i, *prev_ids, nslotbits; |
| + | uint8_t *prev_ids, nslotbits; |
| uint16_t prev_slots; | |
| char **prev_data; | |
| size_t nslots; | |
| @@ -152,9 +152,12 @@ static bool u8_strset_grow(struct u8_strset *set) | |
| set->slotmask = CURL_U8_SLOT_MASK(set->slotbits); | |
| set->count = 0; | |
| /* re-add previous entries */ | |
| - | for(i = 0; i < CURL_U8_SLOT_CNT(prev_slots); ++i) { |
| - | if(prev_data[i]) |
| - | u8_strset_addn(set, prev_ids[i], prev_data[i]); |
| + | { |
| + | uint16_t i; |
| + | for(i = 0; i < CURL_U8_SLOT_CNT(prev_slots); ++i) { |
| + | if(prev_data[i]) |
| + | u8_strset_addn(set, prev_ids[i], prev_data[i]); |
| + | } |
| } | |
| if(prev_data != set->sdata) | |
| curlx_free(prev_data); | |