Skip to content

ezlib_drv: avoid overflow when OOM #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ezlib_drv: avoid overflow when OOM #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 50 additions & 11 deletions c_src/ezlib_drv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,45 @@ typedef struct {
z_stream *i_stream;
} ezlib_data;

/* Wrappers around driver_alloc() that check */
/* for OOM. */
#ifdef HAS_ERTS_EXIT
void erts_exit(int n, char* v, ...);
#define erl_exit erts_exit
#else
void erl_exit(int n, char* v, ...) { abort(); }
#endif

void *ezlib_alloc(ErlDrvSizeT size);
ErlDrvBinary *ezlib_alloc_binary(ErlDrvSizeT size);
ErlDrvBinary *ezlib_realloc_binary(ErlDrvBinary *bin,
ErlDrvSizeT size);

void *ezlib_alloc(ErlDrvSizeT size) {
void *p = driver_alloc(size);
if (p == NULL) {
erl_exit(1, "ezlib: Can't allocate %lu bytes of memory\n",
size);
}
return p;
}

ErlDrvBinary *ezlib_alloc_binary(ErlDrvSizeT size) {
ErlDrvBinary *p = driver_alloc_binary(size);
if (p == NULL) {
erl_exit(1, "ezlib: Can't allocate %lu binary\n", size);
}
return p;
}

ErlDrvBinary *ezlib_realloc_binary(ErlDrvBinary *bin, ErlDrvSizeT size) {
ErlDrvBinary *p = driver_realloc_binary(bin, size);
if (p == NULL) {
erl_exit(1, "ezlib: Can't reallocate %lu binary\n", size);
}
return p;
}

static void* zlib_alloc(void* data, unsigned int items, unsigned int size)
{
return (void*) driver_alloc(items*size);
Expand All @@ -51,18 +90,18 @@ static void zlib_free(void* data, void* addr)
static ErlDrvData ezlib_drv_start(ErlDrvPort port, char *buff)
{
ezlib_data *d =
(ezlib_data *)driver_alloc(sizeof(ezlib_data));
ezlib_alloc(sizeof(ezlib_data));
d->port = port;

d->d_stream = (z_stream *)driver_alloc(sizeof(z_stream));
d->d_stream = ezlib_alloc(sizeof(z_stream));

d->d_stream->zalloc = zlib_alloc;
d->d_stream->zfree = zlib_free;
d->d_stream->opaque = (voidpf)0;

deflateInit(d->d_stream, Z_DEFAULT_COMPRESSION);

d->i_stream = (z_stream *)driver_alloc(sizeof(z_stream));
d->i_stream = ezlib_alloc(sizeof(z_stream));

d->i_stream->zalloc = zlib_alloc;
d->i_stream->zfree = zlib_free;
Expand Down Expand Up @@ -96,7 +135,7 @@ static void ezlib_drv_stop(ErlDrvData handle)
if (!(cond)) \
{ \
rlen = strlen(errstr) + 1; \
b = driver_realloc_binary(b, rlen); \
b = ezlib_realloc_binary(b, rlen); \
b->orig_bytes[0] = 1; \
strncpy(b->orig_bytes + 1, errstr, rlen - 1); \
*rbuf = (char *)b; \
Expand All @@ -119,7 +158,7 @@ static ErlDrvSSizeT ezlib_drv_control(ErlDrvData handle,
case DEFLATE:
size = BUF_SIZE + 1;
rlen = 1;
b = driver_alloc_binary(size);
b = ezlib_alloc_binary(size);
b->orig_bytes[0] = 0;

d->d_stream->next_in = (unsigned char *)buf;
Expand All @@ -145,15 +184,15 @@ static ErlDrvSSizeT ezlib_drv_control(ErlDrvData handle,

rlen += (BUF_SIZE - d->d_stream->avail_out);
size += (BUF_SIZE - d->d_stream->avail_out);
b = driver_realloc_binary(b, size);
b = ezlib_realloc_binary(b, size);
}
b = driver_realloc_binary(b, rlen);
b = ezlib_realloc_binary(b, rlen);
*rbuf = (char *)b;
return rlen;
case INFLATE:
size = BUF_SIZE + 1;
rlen = 1;
b = driver_alloc_binary(size);
b = ezlib_alloc_binary(size);
b->orig_bytes[0] = 0;

if (len > 0) {
Expand All @@ -180,15 +219,15 @@ static ErlDrvSSizeT ezlib_drv_control(ErlDrvData handle,

rlen += (BUF_SIZE - d->i_stream->avail_out);
size += (BUF_SIZE - d->i_stream->avail_out);
b = driver_realloc_binary(b, size);
b = ezlib_realloc_binary(b, size);
}
}
b = driver_realloc_binary(b, rlen);
b = ezlib_realloc_binary(b, rlen);
*rbuf = (char *)b;
return rlen;
}

b = driver_alloc_binary(1);
b = ezlib_alloc_binary(1);
b->orig_bytes[0] = 0;
*rbuf = (char *)b;
return 1;
Expand Down
7 changes: 6 additions & 1 deletion rebar.config.script
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,12 @@ ModCfg0 = fun(F, Cfg, [Key|Tail], Op, Default) ->
ModCfg = fun(Cfg, Keys, Op, Default) -> ModCfg0(ModCfg0, Cfg, Keys, Op, Default) end.
ModCfgS = fun(Cfg, Keys, Val) -> ModCfg0(ModCfg0, Cfg, Keys, fun(_V) -> Val end, "") end.

Cfg0 = ModCfg(CONFIG, [port_env, "CFLAGS"], fun(V) -> V ++ " " ++ CfgCFlags end, "$CFLAGS"),
SysVersion = lists:map(fun erlang:list_to_integer/1,
string:tokens(erlang:system_info(version), ".")),

ExitFlag = case SysVersion >= [7, 3] of true -> "-DHAS_ERTS_EXIT"; _ -> "" end.

Cfg0 = ModCfg(CONFIG, [port_env, "CFLAGS"], fun(V) -> V ++ " " ++ ExitFlag ++ " " ++ CfgCFlags end, "$CFLAGS"),
Cfg00 = ModCfg(Cfg0, [port_env, "LDFLAGS"], fun(V) -> V ++ " " ++ CfgLDFlags end, "$LDFLAGS"),
Cfg1 = case CfgWithGCov of
"true" ->
Expand Down