Age | Commit message (Collapse) | Author | Files | Lines |
|
Type: fix
Change-Id: If59a66aae658dd35dbcb4987ab00c306b3c6e2e2
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Type: improvement
Change-Id: I57a9f85f7df1fc48656b72592349f4c544302f77
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
While https://gerrit.fd.io/r/c/vpp/+/26948 fixed avoid using -1 to
index into h->free_lists[b][l] by changing the loop counter, the
check for the value of the loop counter (l < 0) cannot be trusted
to decide whether we've found a large enough object within the bin
or not. When the loop is terminated, the value of the variable l
could be ambiguous if it equals to 0 and it is never less than 0,
ie, when we bail out of the loop, we don't know if it was due to the
breaking out of the condition in
if ((s = f_size - size) >= 0)
break;
or
while (l > 0);
The fix is to explicitly set a variable when we have found a large enough
object inside the loop to be used to test whether the loop was prematurely
terminated (found == 1) or the loop just ran exhausted (found == 0)
Type: fix
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I0161813fbd44dcba8982a767eac2e0930e9d77e3
|
|
In search_free_list(), we have this do while loop.
do
{
l--;
f_index = h->free_lists[b][l];
f = elt_at (h, f_index);
f_size = heap_elt_size (v, f);
if ((s = f_size - size) >= 0)
break;
}
while (l >= 0);
When (l == 0), we still go back up to execute l--. Then l become -1. The
next statement is we index h->free_lists[b][-1]. After that, elt_at() would
probably cause a crash in the ASSERT.
Type: fix
Ticket: VPPSUPP-63
Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I617d122aa221cfdfe38f8be50f4e0f0e76e11bb5
|
|
Change-Id: Ied34720ca5a6e6e717eea4e86003e854031b6eab
Signed-off-by: Dave Barach <dave@barachs.net>
|
|
Change-Id: I7b51f88292e057c6443b12224486f2d0c9f8ae23
Signed-off-by: Damjan Marion <damarion@cisco.com>
|