* malloc: ensure set_max_fast never stores zero
@ 2020-04-04 5:52 DJ Delorie
2020-04-04 16:10 ` Carlos O'Donell
0 siblings, 1 reply; 4+ messages in thread
From: DJ Delorie @ 2020-04-04 5:52 UTC (permalink / raw)
To: libc-alpha
The code for set_max_fast() stores an "impossibly small value"
instead of zero, when the parameter is zero. However, for
small values of the parameter (ex: 1 or 2) the computation
results in a zero being stored anyway.
This patch checks for the parameter being small enough for the
computation to result in zero instead, so that a zero is never
stored.
key values which result in zero being stored:
x86-64: 1..7 (or other 64-bit)
i686: 1..11
armhfp: 1..3 (or other 32-bit)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 6acb5ad43a..ee87ddbbf9 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -1632,7 +1632,7 @@ static INTERNAL_SIZE_T global_max_fast;
*/
#define set_max_fast(s) \
- global_max_fast = (((s) == 0) \
+ global_max_fast = (((size_t) (s) <= MALLOC_ALIGN_MASK - SIZE_SZ) \
? MIN_CHUNK_SIZE / 2 : ((s + SIZE_SZ) & ~MALLOC_ALIGN_MASK))
static inline INTERNAL_SIZE_T
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: malloc: ensure set_max_fast never stores zero
2020-04-04 5:52 malloc: ensure set_max_fast never stores zero DJ Delorie
@ 2020-04-04 16:10 ` Carlos O'Donell
2020-04-06 20:29 ` DJ Delorie
0 siblings, 1 reply; 4+ messages in thread
From: Carlos O'Donell @ 2020-04-04 16:10 UTC (permalink / raw)
To: DJ Delorie, libc-alpha
On 4/4/20 1:52 AM, DJ Delorie via Libc-alpha wrote:
>
> The code for set_max_fast() stores an "impossibly small value"
> instead of zero, when the parameter is zero. However, for
> small values of the parameter (ex: 1 or 2) the computation
> results in a zero being stored anyway.
Agreed.
> This patch checks for the parameter being small enough for the
> computation to result in zero instead, so that a zero is never
> stored.
Right, because (1 + SIZE_SZ) & ~MALLOC_ALIGN_MASK is zero.
> key values which result in zero being stored:
>
> x86-64: 1..7 (or other 64-bit)
> i686: 1..11
> armhfp: 1..3 (or other 32-bit)
>
OK with bug # attached.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
> diff --git a/malloc/malloc.c b/malloc/malloc.c
> index 6acb5ad43a..ee87ddbbf9 100644
> --- a/malloc/malloc.c
> +++ b/malloc/malloc.c
> @@ -1632,7 +1632,7 @@ static INTERNAL_SIZE_T global_max_fast;
> */
>
> #define set_max_fast(s) \
> - global_max_fast = (((s) == 0) \
> + global_max_fast = (((size_t) (s) <= MALLOC_ALIGN_MASK - SIZE_SZ) \
> ? MIN_CHUNK_SIZE / 2 : ((s + SIZE_SZ) & ~MALLOC_ALIGN_MASK))
>
> static inline INTERNAL_SIZE_T
>
--
Cheers,
Carlos.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-04-06 20:33 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-04 5:52 malloc: ensure set_max_fast never stores zero DJ Delorie
2020-04-04 16:10 ` Carlos O'Donell
2020-04-06 20:29 ` DJ Delorie
2020-04-06 20:33 ` Carlos O'Donell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).