diff options
| author | Joel Sherrill <joel.sherrill@OARcorp.com> | 2000-11-28 21:47:27 +0000 |
|---|---|---|
| committer | Joel Sherrill <joel.sherrill@OARcorp.com> | 2000-11-28 21:47:27 +0000 |
| commit | 99cfdc2dea1e6a8514fc87bec8543542a76ce593 (patch) | |
| tree | d313100be75bdd38e52a019b4293b0738532799b | |
| parent | 2000-11-20 Dmitry Kargapolov <dk@gentex.ru> (diff) | |
| download | rtems-99cfdc2dea1e6a8514fc87bec8543542a76ce593.tar.bz2 | |
2000-11-28 Chris Johns <ccj@acm.org>
* src/heapallocate.c: Do not allow the size to overflow when
adjusting it. A test allocated a stack of -1 (~0). This
actually resulted in a stack being allocated but with a
size of 0xb. The allocator did not test the size to see if
it rolled through 0 and so allowed the allocation to happen, the
thread to get created. The task crashed as you would expect.
| -rw-r--r-- | c/src/exec/score/src/heapallocate.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/c/src/exec/score/src/heapallocate.c b/c/src/exec/score/src/heapallocate.c index 661a4ba0f7..3699a6b080 100644 --- a/c/src/exec/score/src/heapallocate.c +++ b/c/src/exec/score/src/heapallocate.c @@ -43,7 +43,15 @@ void *_Heap_Allocate( Heap_Block *temporary_block; void *ptr; unsigned32 offset; - + + /* + * Catch the case of a user allocating close to the limit of the + * unsigned32. + */ + + if ( size >= (-1 - HEAP_BLOCK_USED_OVERHEAD) ) + return( NULL ); + excess = size % the_heap->page_size; the_size = size + the_heap->page_size + HEAP_BLOCK_USED_OVERHEAD; |