Add overflow-safe pmem_malloc_array function

This commit is contained in:
Levi Neely 2026-03-08 16:04:20 +01:00
parent 964a5fcde9
commit 3f7f9d716c
5 changed files with 44 additions and 29 deletions

View File

@ -314,10 +314,9 @@ static binresult *do_parse_result(unsigned char **restrict indata,
arr = NULL;
cnt = 0;
alloc = 128;
arr = (binresult **)pmem_malloc(PMEM_SUBSYS_API, alloc * sizeof(binresult *));
arr = (binresult **)pmem_malloc_array(PMEM_SUBSYS_API, alloc, sizeof(binresult *));
if (!arr)
return NULL;
memset(arr, 0, alloc * sizeof(binresult *));
while (**indata != RPARAM_END) {
if (cnt == alloc) {
binresult **tmp;
@ -348,10 +347,9 @@ static binresult *do_parse_result(unsigned char **restrict indata,
arr = NULL;
cnt = 0;
alloc = 32;
arr = (struct _hashpair *)pmem_malloc(PMEM_SUBSYS_API, alloc * sizeof(struct _hashpair));
arr = (struct _hashpair *)pmem_malloc_array(PMEM_SUBSYS_API, alloc, sizeof(struct _hashpair));
if (!arr)
return NULL;
memset(arr, 0, alloc * sizeof(struct _hashpair));
while (**indata != RPARAM_END) {
if (cnt == alloc) {
struct _hashpair *tmp;
@ -401,16 +399,14 @@ static binresult *parse_result(unsigned char *data, size_t datalen) {
retlen = calc_ret_len(&datac, &datalenc, &strcnt);
if (retlen == -1)
return NULL;
datac = pmem_malloc(PMEM_SUBSYS_API, retlen * sizeof(unsigned char));
datac = pmem_malloc_array(PMEM_SUBSYS_API, retlen, sizeof(unsigned char));
if (!datac)
return NULL;
memset(datac, 0, retlen * sizeof(unsigned char));
strings = pmem_malloc(PMEM_SUBSYS_API, strcnt * sizeof(binresult *));
strings = pmem_malloc_array(PMEM_SUBSYS_API, strcnt, sizeof(binresult *));
if (!strings) {
pmem_free(PMEM_SUBSYS_API, datac);
return NULL;
}
memset(strings, 0, strcnt * sizeof(binresult *));
strcnt = 0;
res = do_parse_result(&data, &datac, strings, &strcnt);
pmem_free(PMEM_SUBSYS_API, strings);

View File

@ -104,20 +104,18 @@ int do_psync_account_stopshare(psync_shareid_t usershareids[], int nusershareid,
if (unlikely(numparam == 1))
return -3;
t = (binparam *)pmem_malloc(PMEM_SUBSYS_API, numparam * sizeof(binparam));
t = (binparam *)pmem_malloc_array(PMEM_SUBSYS_API, numparam, sizeof(binparam));
if (!t)
return -1;
memset(t, 0, numparam * sizeof(binparam));
init_param_str(t, "auth", psync_my_auth);
if (nusershareid) {
ids1 = (char *)pmem_malloc(PMEM_SUBSYS_API, nusershareid * FOLDERID_ENTRY_SIZE);
ids1 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, nusershareid, FOLDERID_ENTRY_SIZE);
if (!ids1) {
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(ids1, 0, nusershareid * FOLDERID_ENTRY_SIZE);
idsp = ids1;
for (i = 0; i < nusershareid; ++i) {
k = sprintf(idsp, "%lld", (long long)usershareids[i]);
@ -133,14 +131,13 @@ int do_psync_account_stopshare(psync_shareid_t usershareids[], int nusershareid,
}
if (nteamshareid) {
ids2 = (char *)pmem_malloc(PMEM_SUBSYS_API, nteamshareid * FOLDERID_ENTRY_SIZE);
ids2 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, nteamshareid, FOLDERID_ENTRY_SIZE);
if (!ids2) {
if (nusershareid)
pmem_free(PMEM_SUBSYS_API, ids1);
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(ids2, 0, nteamshareid * FOLDERID_ENTRY_SIZE);
idsp = ids2;
for (i = 0; i < nteamshareid; ++i) {
k = sprintf(idsp, "%lld", (long long)teamshareids[i]);
@ -225,28 +222,25 @@ int do_psync_account_modifyshare(psync_shareid_t usrshrids[], uint32_t uperms[],
if (unlikely(numparam == 1))
return -3;
t = (binparam *)pmem_malloc(PMEM_SUBSYS_API, numparam * sizeof(binparam));
t = (binparam *)pmem_malloc_array(PMEM_SUBSYS_API, numparam, sizeof(binparam));
if (!t)
return -1;
memset(t, 0, numparam * sizeof(binparam));
init_param_str(t, "auth", psync_my_auth);
if (nushid) {
ids1 = (char *)pmem_malloc(PMEM_SUBSYS_API, nushid * FOLDERID_ENTRY_SIZE);
ids1 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, nushid, FOLDERID_ENTRY_SIZE);
if (!ids1) {
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(ids1, 0, nushid * FOLDERID_ENTRY_SIZE);
idsp = ids1;
perms1 = (char *)pmem_malloc(PMEM_SUBSYS_API, nushid * FOLDERID_ENTRY_SIZE);
perms1 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, nushid, FOLDERID_ENTRY_SIZE);
if (!perms1) {
pmem_free(PMEM_SUBSYS_API, ids1);
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(perms1, 0, nushid * FOLDERID_ENTRY_SIZE);
permsp = perms1;
for (i = 0; i < nushid; ++i) {
k = sprintf(idsp, "%lld", (long long)usrshrids[i]);
@ -271,7 +265,7 @@ int do_psync_account_modifyshare(psync_shareid_t usrshrids[], uint32_t uperms[],
}
if (ntmshid) {
ids2 = (char *)pmem_malloc(PMEM_SUBSYS_API, ntmshid * FOLDERID_ENTRY_SIZE);
ids2 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, ntmshid, FOLDERID_ENTRY_SIZE);
if (!ids2) {
if (nushid) {
pmem_free(PMEM_SUBSYS_API, perms1);
@ -280,9 +274,8 @@ int do_psync_account_modifyshare(psync_shareid_t usrshrids[], uint32_t uperms[],
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(ids2, 0, ntmshid * FOLDERID_ENTRY_SIZE);
idsp = ids2;
perms2 = (char *)pmem_malloc(PMEM_SUBSYS_API, ntmshid * FOLDERID_ENTRY_SIZE);
perms2 = (char *)pmem_malloc_array(PMEM_SUBSYS_API, ntmshid, FOLDERID_ENTRY_SIZE);
if (!perms2) {
pmem_free(PMEM_SUBSYS_API, ids2);
if (nushid) {
@ -292,7 +285,6 @@ int do_psync_account_modifyshare(psync_shareid_t usrshrids[], uint32_t uperms[],
pmem_free(PMEM_SUBSYS_API, t);
return -1;
}
memset(perms2, 0, ntmshid * FOLDERID_ENTRY_SIZE);
permsp = perms2;
for (i = 0; i < ntmshid; ++i) {

View File

@ -136,3 +136,31 @@ void *pmem_realloc(pmem_subsystem_t subsystem, void *ptr, size_t size) {
size_t pmem_get_stats(pmem_subsystem_t subsystem) {
return __atomic_load_n(&subsystem_stats[subsystem], __ATOMIC_RELAXED);
}
void *pmem_malloc_array(pmem_subsystem_t subsystem, size_t nmemb, size_t size) {
pmem_header_t *hdr;
size_t alloc_size;
size_t total_size;
void *ptr;
if (nmemb != 0 && size > SIZE_MAX / nmemb) {
return NULL;
}
alloc_size = nmemb * size;
total_size = sizeof(pmem_header_t) + alloc_size;
hdr = (pmem_header_t *)malloc(total_size);
if (!hdr) {
return NULL;
}
hdr->size = alloc_size;
hdr->subsystem = subsystem;
__atomic_add_fetch(&subsystem_stats[subsystem], alloc_size, __ATOMIC_RELAXED);
ptr = (void *)(hdr + 1);
memset(ptr, 0, alloc_size);
return ptr;
}

View File

@ -23,6 +23,7 @@ void *pmem_calloc_safe(size_t nmemb, size_t size);
void *pmem_malloc(pmem_subsystem_t subsystem, size_t size);
void pmem_free(pmem_subsystem_t subsystem, void *ptr);
void *pmem_realloc(pmem_subsystem_t subsystem, void *ptr, size_t size);
void *pmem_malloc_array(pmem_subsystem_t subsystem, size_t nmemb, size_t size);
size_t pmem_get_stats(pmem_subsystem_t subsystem);
#endif

View File

@ -136,11 +136,10 @@ int ptools_create_backend_event(const char *binapi, const char *category,
paramsLocal[5] = (binparam)PAPI_NUM(EPARAM_TIME, etime);
if (pCnt > 0) {
keyParams = (char *)pmem_malloc(PMEM_SUBSYS_OTHER, pCnt * 258);
keyParams = (char *)pmem_malloc_array(PMEM_SUBSYS_OTHER, pCnt, 258);
if (!keyParams) {
return -1;
}
memset(keyParams, 0, pCnt * 258);
keyParams[0] = 0;
for (i = 0; i < pCnt; i++) {
@ -376,7 +375,7 @@ int ptools_backend_call(const char *binapi, const char *wsPath,
if (strlen(payloadName) > 0) {
payload = (binresult *)papi_find_result2(res, payloadName, PARAM_HASH);
*resData = (binresult *)pmem_malloc(PMEM_SUBSYS_OTHER, payload->length * sizeof(binresult));
*resData = (binresult *)pmem_malloc_array(PMEM_SUBSYS_OTHER, payload->length, sizeof(binresult));
if (!*resData) {
return -1;
}
@ -458,11 +457,10 @@ void ptools_send_psyncs_event(const char *binapi, const char *auth) {
int intRes;
int syncCnt = 0;
errMsg = (char *)pmem_malloc(PMEM_SUBSYS_OTHER, 1024 * sizeof(char));
errMsg = (char *)pmem_malloc_array(PMEM_SUBSYS_OTHER, 1024, sizeof(char));
if (!errMsg) {
return;
}
memset(errMsg, 0, 1024 * sizeof(char));
errMsg[0] = 0;
time(&rawtime);