[tor-commits] [tor/maint-0.2.2] Correct the handling of overflow behavior in smartlist_ensure_capacity

[nickm at torproject.org]

commit e1c6431e42bc6b5619c78008cbe92730ead57bbf
Author: Nick Mathewson <nickm at torproject.org>
Date:   Wed Nov 9 12:08:28 2011 -0500

    Correct the handling of overflow behavior in smartlist_ensure_capacity
    
    The old behavior was susceptible to the compiler optimizing out our
    assertion check, *and* could still overflow size_t on 32-bit systems
    even when it did work.
---
 changes/bug4230        |    5 +++++
 src/common/container.c |   19 ++++++++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/changes/bug4230 b/changes/bug4230
new file mode 100644
index 0000000..c1ba584
--- /dev/null
+++ b/changes/bug4230
@@ -0,0 +1,5 @@
+  o Minor bugfixes:
+    - Resolve an integer overflow bug in smartlist_ensure_capacity.
+      Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by 
+      Mansour Moufid.
+
diff --git a/src/common/container.c b/src/common/container.c
index c741eb0..edfcd97 100644
--- a/src/common/container.c
+++ b/src/common/container.c
@@ -61,13 +61,22 @@ smartlist_clear(smartlist_t *sl)
 static INLINE void
 smartlist_ensure_capacity(smartlist_t *sl, int size)
 {
+#if SIZEOF_SIZE_T > SIZEOF_INT
+#define MAX_CAPACITY (INT_MAX)
+#else
+#define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*))))
+#endif
   if (size > sl->capacity) {
-    int higher = sl->capacity * 2;
-    while (size > higher)
-      higher *= 2;
-    tor_assert(higher > 0); /* detect overflow */
+    int higher = sl->capacity;
+    if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) {
+      tor_assert(size <= MAX_CAPACITY);
+      higher = MAX_CAPACITY;
+    } else {
+      while (size > higher)
+        higher *= 2;
+    }
     sl->capacity = higher;
-    sl->list = tor_realloc(sl->list, sizeof(void*)*sl->capacity);
+    sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity));
   }
 }