lihao/jemalloc
1
0
Fork 0
mirror of https://github.com/jemalloc/jemalloc.git synced 2026-07-24 22:03:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix wrong type for malloc_read_fd return value in prof_stack_range

Browse Source 
Used size_t (unsigned) instead of ssize_t for the return value of
malloc_read_fd, which returns -1 on error. With size_t, -1 becomes
a huge positive value, bypassing the error check and corrupting the
remaining byte count.
This commit is contained in:
Slobodan Predolac
2026-03-27 10:04:36 -07:00
parent dd30c91eaa
commit 3f6e63e86a
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/prof_stack_range.c
View File

@@ -73,17 +73,21 @@ prof_mapping_containing_addr(uintptr_t addr, const char *maps_path,
} }
remaining = malloc_read_fd(fd, buf, sizeof(buf)); remaining = malloc_read_fd(fd, buf, sizeof(buf));
if (remaining <= 0) { if (remaining < 0) {
ret = errno; ret = errno;
break; break;
} else if (remaining == 0) {
break;
} }
line = buf; line = buf;
} else if (line == NULL) { } else if (line == NULL) {
/* case 1: no newline found in buf */ /* case 1: no newline found in buf */
remaining = malloc_read_fd(fd, buf, sizeof(buf)); remaining = malloc_read_fd(fd, buf, sizeof(buf));
if (remaining <= 0) { if (remaining < 0) {
ret = errno; ret = errno;
break; break;
} else if (remaining == 0) {
break;
} }
line = memchr(buf, '\n', remaining); line = memchr(buf, '\n', remaining);
if (line != NULL) { if (line != NULL) {
@@ -99,11 +103,13 @@ prof_mapping_containing_addr(uintptr_t addr, const char *maps_path,
remaining); /* copy remaining characters to start of buf */ remaining); /* copy remaining characters to start of buf */
line = buf; line = buf;
size_t count = malloc_read_fd( ssize_t count = malloc_read_fd(
fd, buf + remaining, sizeof(buf) - remaining); fd, buf + remaining, sizeof(buf) - remaining);
if (count <= 0) { if (count < 0) {
ret = errno; ret = errno;
break; break;
} else if (count == 0) {
break;
} }
remaining += remaining +=