matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity

lib: fix _hash_member() crash w/ empty hash

Browse source 
The typesafe hash _member() didn't check tabshift/count before
proceeding to look at the hash table, leading it to dereference a NULL
pointer when the hash table is in fact empty.

Test case added to tests/lib/test_typelist.

Note this function is not currently used anywhere.  Only lib/cspf.c uses
_member(), but it does so on a RB-tree rather than a hash.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
This commit is contained in:
David Lamparter 2023-04-21 16:23:39 +02:00
parent ae19023b8e
commit 5523a505f4
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/typesafe.h
View file

@ -948,6 +948,8 @@ macro_pure size_t prefix ## _count(const struct prefix##_head *h) \
macro_pure bool prefix ## _member(const struct prefix##_head *h, \ macro_pure bool prefix ## _member(const struct prefix##_head *h, \
const type *item) \ const type *item) \
{ \ { \
if (!h->hh.tabshift) \
return NULL; \
uint32_t hval = item->field.hi.hashval, hbits = HASH_KEY(h->hh, hval); \ uint32_t hval = item->field.hi.hashval, hbits = HASH_KEY(h->hh, hval); \
const struct thash_item *hitem = h->hh.entries[hbits]; \ const struct thash_item *hitem = h->hh.entries[hbits]; \
while (hitem && hitem->hashval < hval) \ while (hitem && hitem->hashval < hval) \

5
tests/lib/test_typelist.h
View file

@ -171,6 +171,11 @@ static void concat(test_, TYPE)(void)
ts_hash("init", "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119"); ts_hash("init", "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119");
#if !IS_ATOMIC(REALTYPE)
assert(!list_member(&head, &itm[0]));
assert(!list_member(&head, &itm[1]));
#endif
#if IS_SORTED(REALTYPE) #if IS_SORTED(REALTYPE)
prng = prng_new(0); prng = prng_new(0);
k = 0; k = 0;