Browse Source

Fix accidental double-free in KJS garbage collector

This resolves Bug 2116
Timothy Pearson 4 years ago
parent
commit
36a7df39b0
1 changed files with 6 additions and 1 deletions
  1. 6
    1
      kjs/collector.cpp

+ 6
- 1
kjs/collector.cpp View File

@@ -24,6 +24,7 @@
24 24
 #include "value.h"
25 25
 #include "internal.h"
26 26
 #include <limits.h>
27
+#include <typeinfo>
27 28
 
28 29
 #ifndef MAX
29 30
 #define MAX(a,b) ((a) > (b) ? (a) : (b))
@@ -121,7 +122,7 @@ void* Collector::allocate(size_t s)
121 122
 
122 123
     if (heap.usedBlocks == heap.numBlocks) {
123 124
       static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
124
-      if (heap.numBlocks > maxNumBlocks)
125
+      if ((size_t)heap.numBlocks > maxNumBlocks)
125 126
           return 0L;
126 127
       heap.numBlocks = MAX(MIN_ARRAY_SIZE, heap.numBlocks * GROWTH_FACTOR);
127 128
       heap.blocks = (CollectorBlock **)realloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock *));
@@ -222,6 +223,10 @@ bool Collector::collect()
222 223
       if (!(imp->_flags & ValueImp::VI_DESTRUCTED)) {
223 224
 	if (!imp->refcount && imp->_flags == (ValueImp::VI_GCALLOWED | ValueImp::VI_CREATED)) {
224 225
 	  //fprintf( stderr, "[kjs-collector] Collector::deleting ValueImp %p (%s)\n", (void*)imp, typeid(*imp).name());
226
+
227
+	  // prevent double free
228
+	  imp->_flags |= ValueImp::VI_DESTRUCTED;
229
+
225 230
 	  // emulate destructing part of 'operator delete()'
226 231
 	  imp->~ValueImp();
227 232
 	  curBlock->usedCells--;

Loading…
Cancel
Save