Fixed heap overflow caused by vector_resize
This commit is contained in:
3
.gitignore
vendored
3
.gitignore
vendored
@@ -53,3 +53,6 @@ dkms.conf
|
||||
|
||||
# debug information files
|
||||
*.dwo
|
||||
|
||||
# Visual Studio Code
|
||||
.vscode/
|
||||
|
||||
2
Makefile
2
Makefile
@@ -1,7 +1,7 @@
|
||||
CC = gcc
|
||||
CFLAGS = -Wall -Wextra -Werror -pedantic-errors -fstack-protector-strong \
|
||||
-fsanitize=address -fsanitize=undefined -fstack-clash-protection \
|
||||
-Wwrite-strings -std=c99
|
||||
-Wwrite-strings -g -std=c99
|
||||
|
||||
SRC_DIR = src
|
||||
OBJ_DIR = obj
|
||||
|
||||
11
src/vector.c
11
src/vector.c
@@ -70,18 +70,18 @@ vector_result_t vector_new(size_t size, size_t data_size) {
|
||||
vector_result_t vector_resize(vector_t *vector) {
|
||||
vector_result_t result = {0};
|
||||
|
||||
size_t old_capacity = vector->capacity;
|
||||
vector->capacity = (old_capacity > 0 ? ((old_capacity * 3) / 2) : 1);
|
||||
const size_t old_capacity = vector->capacity;
|
||||
const size_t new_capacity = old_capacity > 0 ? old_capacity * 2 : 1;
|
||||
|
||||
// Check for stack overflow errors
|
||||
if (vector->capacity > SIZE_MAX / vector->data_size) {
|
||||
if (new_capacity > SIZE_MAX / vector->data_size) {
|
||||
result.status = VECTOR_ERR_OVERFLOW;
|
||||
SET_MSG(result, "Exceeded maximum size while resizing vector");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
void *new_elements = realloc(vector->elements, (vector->capacity * vector->data_size));
|
||||
void *new_elements = realloc(vector->elements, new_capacity * vector->data_size);
|
||||
if (new_elements == NULL) {
|
||||
result.status = VECTOR_ERR_ALLOCATE;
|
||||
SET_MSG(result, "Failed to reallocate memory for vector");
|
||||
@@ -90,6 +90,7 @@ vector_result_t vector_resize(vector_t *vector) {
|
||||
}
|
||||
|
||||
vector->elements = new_elements;
|
||||
vector->capacity = new_capacity;
|
||||
|
||||
result.status = VECTOR_OK;
|
||||
SET_MSG(result, "Vector successfully resized");
|
||||
@@ -184,7 +185,7 @@ vector_result_t vector_push(vector_t *vector, void *value) {
|
||||
}
|
||||
|
||||
// Check whether vector has enough space available
|
||||
if (vector->capacity == vector->size) {
|
||||
if (vector->size == vector->capacity) {
|
||||
result = vector_resize(vector);
|
||||
if (result.status != VECTOR_OK) {
|
||||
return result;
|
||||
|
||||
BIN
tests/test_vector
Executable file
BIN
tests/test_vector
Executable file
Binary file not shown.
@@ -55,7 +55,7 @@ void test_vector_push() {
|
||||
|
||||
// Trigger vector reallocation
|
||||
void test_vector_push_realloc() {
|
||||
vector_result_t res = vector_new(2, sizeof(int));
|
||||
vector_result_t res = vector_new(1, sizeof(int));
|
||||
|
||||
assert(res.status == VECTOR_OK);
|
||||
vector_t *v = res.value.vector;
|
||||
@@ -66,7 +66,7 @@ void test_vector_push_realloc() {
|
||||
}
|
||||
|
||||
assert(vector_size(v) == 5);
|
||||
assert(vector_capacity(v) >= 5);
|
||||
assert(vector_capacity(v) > 5);
|
||||
|
||||
vector_destroy(v);
|
||||
}
|
||||
|
||||
10
usage.c
10
usage.c
@@ -54,8 +54,8 @@ vector_order_t cmp_int_desc(const void *x, const void *y) {
|
||||
}
|
||||
|
||||
int vector_usage() {
|
||||
// Create a vector of 5 integers
|
||||
vector_result_t res = vector_new(5, sizeof(int));
|
||||
// Create a vector of 3 integers
|
||||
vector_result_t res = vector_new(3, sizeof(int));
|
||||
if (res.status != VECTOR_OK) {
|
||||
printf("Error while creating vector: %s\n", res.message);
|
||||
|
||||
@@ -64,8 +64,8 @@ int vector_usage() {
|
||||
|
||||
vector_t *vector = res.value.vector;
|
||||
|
||||
// Push some values
|
||||
for (int idx = 0; idx <= 5; idx++) {
|
||||
// Push some values to trigger reallocation
|
||||
for (int idx = 0; idx < 5; idx++) {
|
||||
vector_result_t add_res = vector_push(vector, &idx);
|
||||
if (add_res.status != VECTOR_OK) {
|
||||
printf("Error while adding elements: %s\n", add_res.message);
|
||||
@@ -76,7 +76,7 @@ int vector_usage() {
|
||||
|
||||
// Print vector size and capacity
|
||||
printf("Vector size (should be 5): %zu\n", vector_size(vector));
|
||||
printf("Vector capacity (should be >= 5): %zu\n\n", vector_capacity(vector));
|
||||
printf("Vector capacity (should be > 5): %zu\n\n", vector_capacity(vector));
|
||||
|
||||
// Print the whole vector
|
||||
for (size_t idx = 0; idx < vector_size(vector); idx++) {
|
||||
|
||||
Reference in New Issue
Block a user