On 11/02/2012 01:14 PM, Paolo Carlini wrote:
On 11/02/2012 01:09 PM, Florian Weimer wrote:
I looked at this again and made a new copy of the test case instead.
It has been successfully tested on x86_64-redhat-linux-gnu.
Is this okay for trunk?
Looks very nice to me, and after all the issue seems rather simple.
Let's say we wait another 2-3 days in case Jason and others have
comments, and then it's Ok for mainline.
Thanks. I made a few formatting changes, so the attached version is
what I committed.
--
Florian Weimer / Red Hat Product Security Team
2012-11-03 Florian Weimer <fwei...@redhat.com>
* libsupc++/vec.cc (compute_size): New.
(__cxa_vec_new2, __cxa_vec_new3): Use it.
* testsuite/18_support/cxa_vec.cc: New.
Index: libstdc++-v3/libsupc++/vec.cc
===================================================================
--- libstdc++-v3/libsupc++/vec.cc (revision 193173)
+++ libstdc++-v3/libsupc++/vec.cc (working copy)
@@ -1,7 +1,6 @@
// New abi Support -*- C++ -*-
-// Copyright (C) 2000, 2001, 2003, 2004, 2009, 2011
-// Free Software Foundation, Inc.
+// Copyright (C) 2000-2012 Free Software Foundation, Inc.
//
// This file is part of GCC.
//
@@ -59,6 +58,19 @@
globals->caughtExceptions = p->nextException;
globals->uncaughtExceptions += 1;
}
+
+ // Compute the total size with overflow checking.
+ std::size_t compute_size(std::size_t element_count,
+ std::size_t element_size,
+ std::size_t padding_size)
+ {
+ if (element_size && element_count > std::size_t(-1) / element_size)
+ throw std::bad_alloc();
+ std::size_t size = element_count * element_size;
+ if (size + padding_size < size)
+ throw std::bad_alloc();
+ return size + padding_size;
+ }
}
// Allocate and construct array.
@@ -83,7 +95,8 @@
void *(*alloc) (std::size_t),
void (*dealloc) (void *))
{
- std::size_t size = element_count * element_size + padding_size;
+ std::size_t size
+ = compute_size(element_count, element_size, padding_size);
char *base = static_cast <char *> (alloc (size));
if (!base)
return base;
@@ -124,7 +137,8 @@
void *(*alloc) (std::size_t),
void (*dealloc) (void *, std::size_t))
{
- std::size_t size = element_count * element_size + padding_size;
+ std::size_t size
+ = compute_size(element_count, element_size, padding_size);
char *base = static_cast<char *>(alloc (size));
if (!base)
return base;
Index: libstdc++-v3/testsuite/18_support/cxa_vec.cc
===================================================================
--- libstdc++-v3/testsuite/18_support/cxa_vec.cc (revision 0)
+++ libstdc++-v3/testsuite/18_support/cxa_vec.cc (working copy)
@@ -0,0 +1,64 @@
+// { dg-do run }
+// Avoid use of none-overridable new/delete operators in shared
+// { dg-options "-static" { target *-*-mingw* } }
+// Test __cxa_vec routines
+// Copyright (C) 2000-2012 Free Software Foundation, Inc.
+// Contributed by Nathan Sidwell 7 Apr 2000 <nathan@nat...@codesourcery.com>
+
+#include <cxxabi.h>
+#include <stdio.h>
+#include <new>
+#include <stdlib.h>
+#include <setjmp.h>
+
+// Allocate enough padding to hold an array cookie.
+#ifdef __ARM_EABI__
+static const size_t padding = 8;
+#else
+static const size_t padding = (sizeof (std::size_t));
+#endif
+
+// our pseudo ctors and dtors
+static abi::__cxa_cdtor_return_type ctor (void *x)
+{
+ abort ();
+}
+
+static abi::__cxa_cdtor_return_type dtor (void *x)
+{
+ abort ();
+}
+
+// allocate an array whose size causes an overflow during multiplication
+void test1 ()
+{
+ static const std::size_t large_size =
+ std::size_t(1) << (sizeof(std::size_t) * 8 - 2);
+ try
+ {
+ abi::__cxa_vec_new (large_size, 8, 0, ctor, dtor);
+ abort ();
+ }
+ catch (std::bad_alloc &)
+ {
+ }
+}
+
+// allocate an array whose size causes an overflow during addition
+void test2 ()
+{
+ try
+ {
+ abi::__cxa_vec_new (std::size_t(-1) / 4, 4, padding, ctor, dtor);
+ abort ();
+ }
+ catch (std::bad_alloc &)
+ {
+ }
+}
+
+int main ()
+{
+ test1 ();
+ test2 ();
+}
