]> granicus.if.org Git - libevent/commit
Protect min_heap_push_ against integer overflow.
authorTobias Stoeckmann <tobias@stoeckmann.org>
Tue, 16 Apr 2019 19:12:21 +0000 (21:12 +0200)
committerAzat Khuzhin <azat@libevent.org>
Wed, 31 Jul 2019 08:26:05 +0000 (11:26 +0300)
commit8c899768236842fcc3c8141f208b917a066713fb
treef60b4f58c2fa867f11fbd241b909e75cde56038c
parent181049739478d57500bd564539f17407437bfe8f
Protect min_heap_push_ against integer overflow.

On 64 bit systems with a lot of memory it is possible to overflow the
counter s->n (unsigned int) which keeps track of the amount of elements
within the heap.

On 32 bit systems with tightly packed memory layout (and adding the
same pointer again and again) an integer overflow could occur if "a"
reaches 2^30 because the multiplication with sizeof *p (4) would
overflow, effectively freeing memory of s->p which eventually leads to
a double free.

No sign of issue for any sane setup and therefore a purely defensive
measurement.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Refs: #799 (first version of the patch for backporting to 2.1.x only)
See-also: 181049739478d57500bd564539f17407437bfe8f ("Revert "Protect min_heap_push_ against integer overflow."")

(cherry picked from commit stoeckmann/libevent@47d348a63130c91f2a6aadef291ff5687275df72)
minheap-internal.h