romenskiy2012/jemalloc
1
0
Fork 0
mirror of https://github.com/jemalloc/jemalloc.git synced 2026-05-01 09:37:50 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix off-by-one in stats_arenas_i_bins_j and stats_arenas_i_lextents_j bounds checks

Browse source 
Same pattern as arenas_bin_i_index: used > instead of >= allowing
access one past the end of bstats[] and lstats[] arrays.

Add unit tests that verify boundary indices return ENOENT.
This commit is contained in:
Slobodan Predolac 2026-03-27 09:57:34 -07:00
parent 959c4f387f
commit f19601dda1
2 changed files with 56 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ctl.c
View file

@ -4003,7 +4003,7 @@ CTL_RO_CGEN(config_stats, stats_arenas_i_bins_j_nonfull_slabs,
static const ctl_named_node_t *
stats_arenas_i_bins_j_index(
tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t j) {
if (j > SC_NBINS) {
if (j >= SC_NBINS) {
return NULL;
}
return super_stats_arenas_i_bins_j_node;
@ -4027,7 +4027,7 @@ CTL_RO_CGEN(config_stats, stats_arenas_i_lextents_j_curlextents,
static const ctl_named_node_t *
stats_arenas_i_lextents_j_index(
tsdn_t *tsdn, const size_t *mib, size_t miblen, size_t j) {
if (j > SC_NSIZES - SC_NBINS) {
if (j >= SC_NSIZES - SC_NBINS) {
return NULL;
}
return super_stats_arenas_i_lextents_j_node;