lihao/jemalloc
1
0
Fork 0
mirror of https://github.com/jemalloc/jemalloc.git synced 2026-07-24 13:53:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix bitmap_ffu out of range read

Browse Source 
We tried to load `g` from `bitmap[i]` before checking it is actually a
valid load. Tweaked a loop a bit to `break` early, when we are done
scanning for bits.

Before this commit undefined behaviour sanitizer from GCC 14+ was
unhappy at `test/unit/bitmap` test with following error.

```
../include/jemalloc/internal/bitmap.h:293:5: runtime error: load of
address 0x7bb1c2e08008 with insufficient space for an object of type
'const bitmap_t'
<...>
    #0 0x62671a149954 in bitmap_ffu ../include/jemalloc/internal/bitmap.h:293
    #1 0x62671a149954 in test_bitmap_xfu_body ../test/unit/bitmap.c:275
    #2 0x62671a14b767 in test_bitmap_xfu ../test/unit/bitmap.c:323
    #3 0x62671a376ad1 in p_test_impl ../test/src/test.c:149
    #4 0x62671a377135 in p_test ../test/src/test.c:200
    #5 0x62671a13da06 in main ../test/unit/bitmap.c:336
<...>
```
This commit is contained in:
Dmitry Ilvokhin
2025-01-24 07:48:58 -08:00
committed by Qi Wang
parent 607b866035
commit ef8e512e29
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
include/jemalloc/internal/bitmap.h
View File

@@ -284,14 +284,17 @@ bitmap_ffu(const bitmap_t *bitmap, const bitmap_info_t *binfo, size_t min_bit) {
bitmap_t g = bitmap[i] & ~((1LU << (min_bit & BITMAP_GROUP_NBITS_MASK)) bitmap_t g = bitmap[i] & ~((1LU << (min_bit & BITMAP_GROUP_NBITS_MASK))
- 1); - 1);
size_t bit; size_t bit;
do { while (1) {
if (g != 0) { if (g != 0) {
bit = ffs_lu(g); bit = ffs_lu(g);
return (i << LG_BITMAP_GROUP_NBITS) + bit; return (i << LG_BITMAP_GROUP_NBITS) + bit;
} }
i++; i++;
if (i >= binfo->ngroups) {
break;
}
g = bitmap[i]; g = bitmap[i];
} while (i < binfo->ngroups); }
return binfo->nbits; return binfo->nbits;
#endif #endif
} }