GNU bug report logs - #9196
integer and memory overflow issues (e.g., cut-and-paste crashes Emacs)

Previous Next

Full log

Message #23 received at 9196 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Jan Djärv <jan.h.d <at> swipnet.se>
Cc: 9196 <at> debbugs.gnu.org
Subject: Re: bug#9196: integer and memory overflow issues (e.g., cut-and-paste
	crashes Emacs)
Date: Sat, 30 Jul 2011 12:16:34 -0700

I take your point that the checks add clutter, so I'll
revise the patch to address that problem, by adding a
couple of memory allocators that do the proper overflow
checking internally, so that callers don't need to
test for integer overflow.

This will take a bit of time to prepare and test, so
please bear with me, but to give you a feel here's a draft
of the revised patch to xgselect.c.  This simplifies
xgselect.c compared to what's in the trunk now.

--- src/xgselect.c	2011-07-01 09:18:46 +0000
+++ src/xgselect.c	2011-07-30 18:19:51 +0000
@@ -54,10 +54,8 @@
   do {
     if (n_gfds > gfds_size)
       {
-        while (n_gfds > gfds_size)
-          gfds_size *= 2;
         xfree (gfds);
-        gfds = xmalloc (sizeof (*gfds) * gfds_size);
+        gfds = xpmalloc (&gfds_size, n_gfds - gfds_size, INT_MAX, sizeof *gfds);
       }
 
     n_gfds = g_main_context_query (context,



On 07/29/11 22:52, Jan Djärv wrote:
> the checks that check for more than 2 billion command line arguments

Those checks are necessary for GNU/Hurd, which places
no limit on command line arguments, which means argc + 2
can overflow.  That being said, the revised patch will address
the clutter problem for the command-line issue as well, and
the resulting emacs.c will be simpler than what's in the
trunk now.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.