Merge pull request #2874 from Flamefire/memory_fixes

Avoid out of bounds access on invalid memory free
This commit is contained in:
Martin Kroeker 2020-10-04 15:16:51 +02:00 committed by GitHub
commit f032d8966e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 178 additions and 177 deletions

View File

@ -1107,7 +1107,7 @@ static volatile int memory_initialized = 0;
/* 1 : Level 2 functions */ /* 1 : Level 2 functions */
/* 2 : Thread */ /* 2 : Thread */
static void blas_memory_cleanup(void* ptr){ static void blas_memory_cleanup(void* ptr){
if (ptr) { if (ptr) {
struct alloc_t ** table = (struct alloc_t **)ptr; struct alloc_t ** table = (struct alloc_t **)ptr;
int pos; int pos;
@ -2882,9 +2882,10 @@ void blas_memory_free(void *free_area){
while ((position < NUM_BUFFERS) && (memory[position].addr != free_area)) while ((position < NUM_BUFFERS) && (memory[position].addr != free_area))
position++; position++;
if (memory[position].addr != free_area) goto error; if (position >= NUM_BUFFERS) goto error;
#ifdef DEBUG #ifdef DEBUG
if (memory[position].addr != free_area) goto error;
printf(" Position : %d\n", position); printf(" Position : %d\n", position);
#endif #endif