diff options
| author | Timothy Pearson <kb9vqf@pearsoncomputing.net> | 2014-09-20 17:38:38 +0000 |
|---|---|---|
| committer | Timothy Pearson <kb9vqf@pearsoncomputing.net> | 2014-09-20 17:38:38 +0000 |
| commit | 36a7df39b0f89c467fc6d9c957a7a30f20d96994 (patch) | |
| tree | 908cbd2e9c41a00dff910793dfc73db44f15990c | |
| parent | 87fd132d0145d36d9eae9cdf521935202db228f7 (diff) | |
| download | tdelibs-36a7df39b0f89c467fc6d9c957a7a30f20d96994.tar.gz tdelibs-36a7df39b0f89c467fc6d9c957a7a30f20d96994.zip | |
Fix accidental double-free in KJS garbage collector
This resolves Bug 2116
| -rw-r--r-- | kjs/collector.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/kjs/collector.cpp b/kjs/collector.cpp index 2ddd635a6..2f7e0faa6 100644 --- a/kjs/collector.cpp +++ b/kjs/collector.cpp @@ -24,6 +24,7 @@ #include "value.h" #include "internal.h" #include <limits.h> +#include <typeinfo> #ifndef MAX #define MAX(a,b) ((a) > (b) ? (a) : (b)) @@ -121,7 +122,7 @@ void* Collector::allocate(size_t s) if (heap.usedBlocks == heap.numBlocks) { static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR; - if (heap.numBlocks > maxNumBlocks) + if ((size_t)heap.numBlocks > maxNumBlocks) return 0L; heap.numBlocks = MAX(MIN_ARRAY_SIZE, heap.numBlocks * GROWTH_FACTOR); heap.blocks = (CollectorBlock **)realloc(heap.blocks, heap.numBlocks * sizeof(CollectorBlock *)); @@ -222,6 +223,10 @@ bool Collector::collect() if (!(imp->_flags & ValueImp::VI_DESTRUCTED)) { if (!imp->refcount && imp->_flags == (ValueImp::VI_GCALLOWED | ValueImp::VI_CREATED)) { //fprintf( stderr, "[kjs-collector] Collector::deleting ValueImp %p (%s)\n", (void*)imp, typeid(*imp).name()); + + // prevent double free + imp->_flags |= ValueImp::VI_DESTRUCTED; + // emulate destructing part of 'operator delete()' imp->~ValueImp(); curBlock->usedCells--; |