Skip to content
This repository was archived by the owner on Aug 19, 2021. It is now read-only.

Commit da9a966

Browse files
committed
Fixed equeue_cancel behaviour on null id
If no event allocation has been performed, an id of zero maps to uninitialized space. Since this may reside in bss, there is a high chance the id of zero is incorrectly matched against the uninitialized slab, causing quick memory corruption as the "event" is unqueued.
1 parent 4d63870 commit da9a966

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

equeue.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ static inline int equeue_clampdiff(unsigned a, unsigned b) {
2626
// Increment the unique id in an event, hiding the event from cancel
2727
static inline void equeue_incid(equeue_t *q, struct equeue_event *e) {
2828
e->id += 1;
29-
if (e->id >> (8*sizeof(int)-1 - q->npw2)) {
29+
if (!(e->id << q->npw2)) {
3030
e->id = 1;
3131
}
3232
}
@@ -341,6 +341,10 @@ int equeue_post(equeue_t *q, void (*cb)(void*), void *p) {
341341
}
342342

343343
void equeue_cancel(equeue_t *q, int id) {
344+
if (!id) {
345+
return;
346+
}
347+
344348
struct equeue_event *e = equeue_unqueue(q, id);
345349
if (e) {
346350
equeue_dealloc(q, e + 1);

0 commit comments

Comments
 (0)