Sfoglia il codice sorgente

Fix overflow in prio_list elements comparison

When both negative and INT_MAX priorities were used this function
would overflow, and rbtree lookup would get lost and return NULL.
Léo Villeveygoux 7 anni fa
parent
commit
3f90d1b387
1 ha cambiato i file con 6 aggiunte e 1 eliminazioni
  1. 6 1
      src/common/prio_list.h

+ 6 - 1
src/common/prio_list.h

@@ -167,7 +167,12 @@
 	{ \
 		/* Sort by decreasing order */ \
 		const struct ENAME##_prio_list_stage *e2 = ENAME##_node_to_list_stage_const(node); \
-		return (e2->prio - prio); \
+		if (e2->prio < prio) \
+			return -1; \
+		if (e2->prio == prio) \
+			return 0; \
+		/* e2->prio > prio */ \
+		return 1; \
 	} \
 	PRIO_LIST_INLINE struct ENAME##_prio_list_stage *ENAME##_prio_list_add(struct ENAME##_prio_list *priolist, int prio) \
 	{ \