fix: zero allocations performed via ALLOCATE

8d33fa030d308e6f5a4572a5b25bde4508757c31 refactored the site of a call to
vmnewof to remove an assumption that the returned allocation was zeroed. However
I failed to notice that the call to ALLOCATE (which eventually invokes vmnewof)
in exnewnode also relied on this assumption. This remained a latent issue until
84b2983edf458098bb6233368904265c92da4e65 whose changes meant the region returned
by vmnewof was no longer zeroed. The issue (now an active bug) still went
unnoticed until ea791d46aa1d0f15c483d424fdddabf8f3b61cb0 was merged, which
contained a test that ran `gvpr -f cmd/gvpr/lib/color </dev/null` that triggered
a read through a bad pointer that should have been zeroed during these
allocations.

To fix this, we conservatively zero the result of all calls to ALLOCATE,
ensuring the assumptions these calls may have previously had is now restored.

diff --git a/lib/expr/exgram.h b/lib/expr/exgram.h
index baad996e1b81b24d7e69c70f315c8fedb47409ed..86d6c02e5baf5eb8b028dd210deee0c5f3151d44 100644 (file)
--- a/lib/expr/exgram.h
+++ b/lib/expr/exgram.h
@@ -61,6 +61,7 @@ exnewnode(Expr_t* p, int op, int binary, int type, Exnode_t* left, Exnode_t* rig
        register Exnode_t*      x;
 
        x = ALLOCATE(p, Exnode_t);
+       memzero(x, sizeof(*x));
        x->op = op;
        x->type = type;
        x->binary = binary;

diff --git a/lib/expr/exparse.y b/lib/expr/exparse.y
index 39159cee2d6dbafef1854bbe42a252d0109dd6a0..d519a89b91df3f13a7ac7fab54953905d8ab2ed4 100644 (file)
--- a/lib/expr/exparse.y
+++ b/lib/expr/exparse.y
@@ -1196,6 +1196,7 @@ members   :       /* empty */
                        Exref_t*        r;
 
                        r = ALLOCATE(expr.program, Exref_t);
+                       memzero(r, sizeof(*r));
                        r->symbol = $1;
                        expr.refs = r;
                        expr.lastref = r;
@@ -1209,10 +1210,12 @@ members :       /* empty */
                        Exref_t*        l;
 
                        r = ALLOCATE(expr.program, Exref_t);
+                       memzero(r, sizeof(*r));
                        r->symbol = $3;
                        r->index = 0;
                        r->next = 0;
                        l = ALLOCATE(expr.program, Exref_t);
+                       memzero(l, sizeof(*l));
                        l->symbol = $2;
                        l->index = 0;
                        l->next = r;