RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 18:27:35 +00:00
Code Issues Activity Actions

LibJS: Fix undefined behavior in HeapBlock

Browse source 
In C++, it's invalid to cast a block of memory to a complex type without
invoking its constructor. It's even more invalid to simply cast a pointer to a
block of memory to a pointer to *an abstract type*.

To fix this, make sure FreelistEntry is a concrete type, and call its
constructor whenever appropriate.
This commit is contained in:
Sergey Bugaev 2020-06-01 17:01:04 +03:00 • committed by Andreas Kling
parent 53a94b8bbd
commit 2fbc37befc
2 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Libraries/LibJS/Heap/HeapBlock.cpp
View file

@ -61,15 +61,16 @@ HeapBlock::HeapBlock(Heap& heap, size_t cell_size)
: m_heap(heap)
, m_cell_size(cell_size)
{
for (size_t i = 0; i < cell_count(); ++i) {
auto* freelist_entry = static_cast<FreelistEntry*>(cell(i));
ASSERT(cell_size >= sizeof(FreelistEntry));
FreelistEntry* next = nullptr;
for (ssize_t i = cell_count() - 1; i >= 0; i--) {
auto* freelist_entry = init_freelist_entry(i);
freelist_entry->set_live(false);
if (i == cell_count() - 1)
freelist_entry->next = nullptr;
else
freelist_entry->next = static_cast<FreelistEntry*>(cell(i + 1));
freelist_entry->next = next;
next = freelist_entry;
}
m_freelist = static_cast<FreelistEntry*>(cell(0));
m_freelist = next;
}
Cell* HeapBlock::allocate()
@ -84,7 +85,7 @@ void HeapBlock::deallocate(Cell* cell)
ASSERT(cell->is_live());
ASSERT(!cell->is_marked());
cell->~Cell();
auto* freelist_entry = static_cast<FreelistEntry*>(cell);
auto* freelist_entry = new (cell) FreelistEntry();
freelist_entry->set_live(false);
freelist_entry->next = m_freelist;
m_freelist = freelist_entry;