#4835 closed defect (fixed)

medit malloc problem of RTEMS (cloned)

Reported by: chenjin_zhong Owned by: Chris Johns
Priority: normal Milestone: 6.1
Component: shell Version: 6
Severity: normal Keywords:
Cc: Blocked By:
Blocking:

Description

Cloned from #4565:


I find malloc function is called by move_gap function in medit.c. The returned value does not check. At least 32KB of memory is allocated at each time, maybe more than. The returned value "start" should be check to avoid malloc failure. The move_gap function should return immediatelty when malloc failure. the code frament is listed as follows.

static void move_gap(struct editor *ed, int pos, int minsize) {

int gapsize = ed->rest - ed->gap;
unsigned char *p = text_ptr(ed, pos);
if (minsize < 0) minsize = 0;
if (minsize <= gapsize) {

if (p != ed->rest) {

if (p < ed->gap) {

memmove(p + gapsize, p, ed->gap - p);

} else {

memmove(ed->gap, ed->rest, p - ed->rest);

}
ed->gap = ed->start + pos;
ed->rest = ed->gap + gapsize;

}

} else {

int newsize;
unsigned char *start;
unsigned char *gap;
unsigned char *rest;
unsigned char *end;

if (gapsize + MINEXTEND > minsize) minsize = gapsize + MINEXTEND;
newsize = (ed->end - ed->start) - gapsize + minsize;
start = (unsigned char *) malloc(newsize); TODO check for out of memory
gap = start + pos;
rest = gap + minsize;
end = start + newsize;

if (p < ed->gap) {

memcpy(start, ed->start, pos);
memcpy(rest, p, ed->gap - p);
memcpy(end - (ed->end - ed->rest), ed->rest, ed->end - ed->rest);

} else {

memcpy(start, ed->start, ed->gap - ed->start);
memcpy(start + (ed->gap - ed->start), ed->rest, p - ed->rest);
memcpy(rest, p, ed->end - p);

}

free(ed->start);
ed->start = start;
ed->gap = gap;
ed->rest = rest;
ed->end = end;

}

#ifdef DEBUG

memset(ed->gap, 0, ed->rest - ed->gap);

#endif

}

Change History (1)

comment:1 Changed on 01/31/23 at 05:17:34 by Chris Johns <chrisj@…>

Resolution: fixed
Status: assignedclosed

In edea93c/rtems:

libmisc/shell/edit: Return if no memory in move_gap

Closes #4835

Note: See TracTickets for help on using tickets.