RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 17:07:35 +00:00
Code Issues Activity Actions

LibJS: Fix undefined behavior in HeapBlock

Browse source 
In C++, it's invalid to cast a block of memory to a complex type without
invoking its constructor. It's even more invalid to simply cast a pointer to a
block of memory to a pointer to *an abstract type*.

To fix this, make sure FreelistEntry is a concrete type, and call its
constructor whenever appropriate.
This commit is contained in:
Sergey Bugaev 2020-06-01 17:01:04 +03:00 • committed by Andreas Kling
parent 53a94b8bbd
commit 2fbc37befc
2 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Libraries/LibJS/Heap/HeapBlock.h
View file

@ -42,8 +42,6 @@ public:
size_t cell_size() const { return m_cell_size; }
size_t cell_count() const { return (block_size - sizeof(HeapBlock)) / m_cell_size; }
Cell* cell(size_t index) { return reinterpret_cast<Cell*>(&m_storage[index * cell_size()]); }
Cell* allocate();
void deallocate(Cell*);
@ -72,10 +70,22 @@ public:
private:
HeapBlock(Heap&, size_t cell_size);
struct FreelistEntry : public Cell {
FreelistEntry* next;
struct FreelistEntry final : public Cell {
FreelistEntry* next { nullptr };
virtual const char* class_name() const override { return "FreelistEntry"; }
};
Cell* cell(size_t index)
{
return reinterpret_cast<Cell*>(&m_storage[index * cell_size()]);
}
FreelistEntry* init_freelist_entry(size_t index)
{
return new (&m_storage[index * cell_size()]) FreelistEntry();
}
Heap& m_heap;
size_t m_cell_size { 0 };
FreelistEntry* m_freelist { nullptr };