Skip to content

Commit f51c132

Browse files
committed
TSRM: roll back id_count when the resource type table cannot grow
ts_allocate_id(), ts_allocate_fast_id_at() and ts_allocate_tls_id() increment id_count before growing resource_types_table. When the realloc fails they return 0 with id_count still counting the new slot, so allocate_new_resource() later walks j < id_count and reads an entry that was never initialized. Roll id_count back on those three paths.
1 parent 1d004f0 commit f51c132

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

TSRM/TSRM.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,7 @@ TSRM_API ts_rsrc_id ts_allocate_id(ts_rsrc_id *rsrc_id, size_t size, ts_allocate
305305
_tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count);
306306
if (!_tmp) {
307307
TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource"));
308+
id_count--;
308309
*rsrc_id = 0;
309310
tsrm_mutex_unlock(tsmm_mutex);
310311
return 0;
@@ -384,6 +385,7 @@ TSRM_API ts_rsrc_id ts_allocate_fast_id_at(ts_rsrc_id *rsrc_id, size_t *offset,
384385
_tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count);
385386
if (!_tmp) {
386387
TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource"));
388+
id_count--;
387389
*rsrc_id = 0;
388390
tsrm_mutex_unlock(tsmm_mutex);
389391
return 0;
@@ -419,6 +421,7 @@ TSRM_API ts_rsrc_id ts_allocate_tls_id(ts_rsrc_id *rsrc_id, void *(*tls_addr)(vo
419421
_tmp = (tsrm_resource_type *) realloc(resource_types_table, sizeof(tsrm_resource_type)*id_count);
420422
if (!_tmp) {
421423
TSRM_ERROR((TSRM_ERROR_LEVEL_ERROR, "Unable to allocate storage for resource"));
424+
id_count--;
422425
*rsrc_id = 0;
423426
tsrm_mutex_unlock(tsmm_mutex);
424427
return 0;

0 commit comments

Comments
 (0)