git-fast-import possible memory corruption problem

Internal "allocate in bulk, we will never free this memory anyway" allocator used in fast-import had a logic to round up the size of the requested memory block in a wrong place (it computed if the available space is enough to fit the request first, and then carved a chunk of memory by size rounded up to the alignment, which could go beyond the actually available space). Signed-off-by: Junio C Hamano <gitster@pobox.com>

YONETANI Tomokazu committed Dec 14, 2008 at 11:08 UTC 2fad5329f4bc03e2328a2994d336c12a9683d9b2

1 file changed +4 -3

fast-import.c

+4 -3

@@ -554,6 +554,10 @@ static void *pool_alloc(size_t len)

554 struct mem_pool *p;

555 void *r;

556

557 + /* round up to a 'uintmax_t' alignment */

558 + if (len & (sizeof(uintmax_t) - 1))

559 + len += sizeof(uintmax_t) - (len & (sizeof(uintmax_t) - 1));

560 +

561 for (p = mem_pool; p; p = p->next_pool)

562 if ((p->end - p->next_free >= len))

563 break;

@@ -572,9 +576,6 @@ static void *pool_alloc(size_t len)

576 }

577

578 r = p->next_free;

575 - /* round out to a 'uintmax_t' alignment */

576 - if (len & (sizeof(uintmax_t) - 1))

577 - len += sizeof(uintmax_t) - (len & (sizeof(uintmax_t) - 1));

579 p->next_free += len;

580 return r;

581 }