romenskiy2012/jemalloc
1
0
Fork 0
mirror of https://github.com/jemalloc/jemalloc.git synced 2026-08-24 16:13:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix off-by-one in stats_arenas_i_bins_j and stats_arenas_i_lextents_j bounds checks

Browse source 
Same pattern as arenas_bin_i_index: used > instead of >= allowing
access one past the end of bstats[] and lstats[] arrays.

Add unit tests that verify boundary indices return ENOENT.
This commit is contained in:
Slobodan Predolac 2026-03-27 09:57:34 -07:00
parent a0f2bdf91d
commit eab2b29736
2 changed files with 56 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ctl.c
View file

@ -3998,7 +3998,7 @@ CTL_RO_CGEN(config_stats, stats_arenas_i_bins_j_nonfull_slabs,
static const ctl_named_node_t *
stats_arenas_i_bins_j_index(
tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t j) {
if (j > SC_NBINS) {
if (j >= SC_NBINS) {
return NULL;
}
return super_stats_arenas_i_bins_j_node;
@ -4022,7 +4022,7 @@ CTL_RO_CGEN(config_stats, stats_arenas_i_lextents_j_curlextents,
static const ctl_named_node_t *
stats_arenas_i_lextents_j_index(
tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t j) {
if (j > SC_NSIZES - SC_NBINS) {
if (j >= SC_NSIZES - SC_NBINS) {
return NULL;
}
return super_stats_arenas_i_lextents_j_node;