fdo-mirrors/dbus
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/dbus/dbus.git synced 2026-05-08 10:18:01 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

dbus-hash: Fix a potential shift by a negative integer

Browse source 
As a hash table becomes unbelievably large and full, the down_shift
tends towards 0. The overflow detection code in rebuild_table() does not
prevent down_shift becoming negative, which then causes undefined
behaviour in RANDOM_INDEX for int-keyed tables.

Note that this can only happen with approaching INT_MAX entries in the
hash table, at which point we’ve almost certainly hit OOM somewhere, so
this is vanishingly unlikely to happen. This is why I can’t add a test
for the bug.

As always, thanks to Coverity.

Coverity ID: 54682
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99641
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
This commit is contained in:
Philip Withnall 2017-02-02 10:14:55 +00:00 • committed by Simon McVittie
parent 9e225f3f8a
commit 33098394ba
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
dbus/dbus-hash.c
View file

@ -941,7 +941,7 @@ rebuild_table (DBusHashTable *table)
{
/* overflow paranoia */
if (table->n_buckets < _DBUS_INT_MAX / 4 &&
table->down_shift >= 0)
table->down_shift >= 2)
new_buckets = table->n_buckets * 4;
else
return; /* can't grow anymore */
@ -993,6 +993,7 @@ rebuild_table (DBusHashTable *table)
_dbus_assert (table->lo_rebuild_size >= 0);
_dbus_assert (table->hi_rebuild_size > table->lo_rebuild_size);
_dbus_assert (table->down_shift >= 0);
_dbus_assert (table->mask != 0);
/* the mask is essentially the max index */
_dbus_assert (table->mask < table->n_buckets);