Skip to content

Commit

Permalink
Fix type confusion in the firewall pointer-based remove.
Browse files Browse the repository at this point in the history
`size()` returns a size in number of objects, however it is substracted
a value in bytes in the pointer-based `remove` function. This results in
various flavors of memory corruption.

Fix the function and ensure that it is covered by the tests.

Signed-off-by: Hugo Lefeuvre <[email protected]>
  • Loading branch information
hlef authored and davidchisnall committed Sep 1, 2024
1 parent 08d962f commit 7d0cf1f
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions lib/firewall/firewall.cc
Original file line number Diff line number Diff line change
Expand Up @@ -319,8 +319,9 @@ namespace
{
memmove(element,
element + 1,
size() - (reinterpret_cast<uint8_t *>(element + 1) -
reinterpret_cast<uint8_t *>(base())));
size() - ((reinterpret_cast<uint8_t *>(element + 1) -
reinterpret_cast<uint8_t *>(base())) /
sizeof(T)));
set_size(size() - 1);
}

Expand Down Expand Up @@ -412,6 +413,14 @@ namespace
testSmallTable.size() == 0,
"Small table size is wrong after removal ({}, expected 0}",
testSmallTable.size());
Debug::log("Testing small table pointer-based remove");
testSmallTable.insert(1);
testSmallTable.remove(testSmallTable.begin());
Debug::Assert(
testSmallTable.size() == 0,
"Small table size is wrong after removal ({}, expected 0}",
testSmallTable.size());

Debug::log("Finished small table tests");
}
}
Expand Down

0 comments on commit 7d0cf1f

Please sign in to comment.