Subject: bug#75551: closed (Re: bug#75551: Potentially erroneous long loop in lrealloc)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 17 Jan 2025 23:58:02 +0000

Your bug report

#75551: Potentially erroneous long loop in lrealloc

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
75551: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=75551
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#75551: Potentially erroneous long loop in lrealloc
From: Paul Eggert <[email-masked]>
To: Hong Xu <[email-masked]>
Cc: [email-masked], Eli Zaretskii <[email-masked]>
Date: Fri, 17 Jan 2025 15:57:05 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

On 2025-01-17 13:05, Hong Xu wrote:
> Thanks, the patch looks good to me and works well on my host!

Thanks for checking. I installed it on the master branch and am marking 
this bug as done.

Subject: Potentially erroneous long loop in lrealloc
From: Hong Xu <[email-masked]>
To: bug-gnu-emacs <[email-masked]>
Date: Mon, 13 Jan 2025 18:30:58 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

lrealloc has a loop that keeps checking alignment by calling laligned:

  while (true)
    {
      p = realloc (p, size);
      if (laligned (p, size) && (size || p))
	return p;
      size_t bigger = size + LISP_ALIGNMENT;
      if (size < bigger)
	size = bigger;
    }

Note that the loop increment size by LISP_ALIGNMENT each time if the
conditions are not satisfied.

One check in aligned is size % LISP_ALIGNMENT != 0:

static bool
laligned (void *p, size_t size)
{
  return (MALLOC_IS_LISP_ALIGNED || (intptr_t) p % LISP_ALIGNMENT == 0
	  || size % LISP_ALIGNMENT != 0);
}

Consider a host where MALLOC_IS_LISP_ALIGNED is false and p %
LISP_ALIGNMENT is frequently nonzero. if lrealloc is called with size
being a multiplier of LISP_ALIGNMENT, the loop can take a long time to
end until p % LISP_ALIGNMENT == 0, potentially until OOM.

Based on my understanding, this part is to address some "oddball" hosts
(based on the comment in alloc.c). But this does seem like a bug to me
if Emacs is running on such an oddball host...

-- 
Hong