Changeset 5299:5fbc169961b9 in roaraudio for libroar

Timestamp:

11/25/11 09:24:14 (12 years ago)

Author:

phi

Branch:

default

Phase:

public

Message:

changed prototype of roar_buffer_moveinto() to avoid use-after-free bugs

File:

• libroar/buffer.c (modified) (5 diffs)

libroar/buffer.c

@@ -95 +95 @@
  if ( buf->refc == 0 ) {
   roar_panic(ROAR_FATAL_ERROR_MEMORY_CORRUPTION, NULL);
+  roar_err_set(ROAR_ERROR_FAULT);
+  return -1;
  }
 
@@ -264 +266 @@
 
 int roar_buffer_add      (struct roar_buffer * buf, struct roar_buffer *  next) {
- return roar_buffer_moveinto(buf, next);
-}
-
-int roar_buffer_moveinto (struct roar_buffer * buf, struct roar_buffer *  next) {
+ return roar_buffer_moveinto(buf, &next);
+}
+
+int roar_buffer_moveinto (struct roar_buffer * buf, struct roar_buffer ** next) {
  unsigned int deep = 0;
 
- _ckbuf(0)
+ _ckbuf(next == NULL || _ckmem_corruption(*next, 0))
 
  ROAR_DBG("buffer_add(buf=%p, next=%p) = ?", buf, next);
+ ROAR_DBG("buffer_add(buf=%p, next=%p): *next=%p", buf, next, *next);
 
  if ( buf->flags & ROAR_BUFFER_FLAG_RING ) {
@@ -279 +282 @@
  }
 
- if ( buf == next ) {
+ if ( buf == *next ) {
   ROAR_ERR("buffer_add(*): both pointer are of the same destination, This is a error in the application");
   roar_err_set(ROAR_ERROR_INVAL);
@@ -291 +294 @@
   deep++;
 
-  if ( buf == next ) {
+  if ( buf == *next ) {
    ROAR_ERR("buffer_add(*): Can not add buffer: loop detected at deep %u. This is a error in the application", deep);
    // why don't we return here?
@@ -297 +300 @@
  }
 
- buf->next = next;
+ buf->next = *next;
 
  ROAR_DBG("buffer_add(*): adding buffer at deep %u", deep);
+
+ *next = NULL;
 
  return 0;