Commit bae5dd6c authored by Nick Mathewson's avatar Nick Mathewson 🤹
Browse files

Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4

parents 7d3fd858 96d32191

changes/bug8844

0 → 100644
+6 −0
Original line number Diff line number Diff line 
  o Major bugfixes:

    - Prevent the get_freelists() function from running off the end of

      the list of freelists if it somehow gets an unrecognized

      allocation. Fixes bug 8844; bugfix on 0.2.0.16-alpha. Reported by

      eugenis.

src/or/buffers.c

+2 −1
Original line number Diff line number Diff line
@@ -148,7 +148,8 @@ static INLINE chunk_freelist_t * 
get_freelist(size_t alloc)

{

  int i;

  for (i=0; freelists[i].alloc_size <= alloc; ++i) {

  for (i=0; (freelists[i].alloc_size <= alloc &&

             freelists[i].alloc_size); ++i ) {

    if (freelists[i].alloc_size == alloc) {

      return &freelists[i];

    }

src/test/test.c

+12 −0
Original line number Diff line number Diff line
@@ -813,6 +813,18 @@ test_buffers(void) 
  buf_free(buf);

  buf = NULL;



  /* Try adding a string too long for any freelist. */

  {

    char *cp = tor_malloc_zero(65536);

    buf = buf_new();

    write_to_buf(cp, 65536, buf);

    tor_free(cp);



    tt_int_op(buf_datalen(buf), ==, 65536);

    buf_free(buf);

    buf = NULL;

  }



 done:

  if (buf)

    buf_free(buf);