Re: [uml-devel] Little heap overflow in mconsole_kern.c

[Geoff Thorpe <geoff@geoffthorpe.net>]

On September 17, 2003 08:22 pm, Jeff Dike wrote:
> blaisorblade_spam@yahoo.it said:
> > While new points to a mconsole_entry, the code allocates
> > sizeof(mc_request),  not sizeof(mconsole_entry)
>
> Gawd, someone really needs to shoot me before I destroy something...

Don't feel bad, I've come down with this bug a few times.

> BTW, It would be a good exercise for someone to go through the code and
> replace instances of
> 	foo = kmalloc(sizeof(type-name), ...)
> with
> 	foo = kmalloc(sizeof(*foo), ...)
>
> That would have prevented this bug.

FWIW: after having this problem one too many times with malloc and 
friends, I started using macros of the form;
  #define MYMALLOC(t,n)  (t *)malloc((n) * sizeof(t))
  #define MYFREE(t,p)    do { \
                             t *_tmp_4567 = (p); \
                             free(_tmp_4567); \
                         } while(0)
These get compiled down to malloc() and free(), respectively. However 
MYMALLOC has the compilation-time advantage of being typesafe according 
to the return value (not void*) and size (which matches the return type). 
The free() variant may seem a bit overkill, but tastes vary. Anyway, if 
you adopt something like this then you can consider any direct use of 
'malloc' and 'free' in the source as bugs and your audit becomes quite a 
bit easier. $0.02, etc.

Cheers,
Geoff

-- 
Geoff Thorpe
geoff@geoffthorpe.net
http://www.geoffthorpe.net/



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel