Changeset 12932

Timestamp:

Sep 28, 2011, 4:07:35 PM (11 years ago)

Author:

jordan

Message:

#4506 'crash from memory corruption somewhere called from tr_handshakeDone()' -- possible fix.

File:

• trunk/libtransmission/bitfield.c (modified) (8 diffs)

trunk/libtransmission/bitfield.c

@@ -171 +171 @@
     assert( b->bit_count > 0 );
 
-    if( b->alloc_count )
+    if( b->alloc_count ) {
+        assert( b->alloc_count <= n );
         memcpy( bits, b->bits, b->alloc_count );
-    else if( tr_bitfieldHasAll( b ) )
+    } else if( tr_bitfieldHasAll( b ) ) {
         set_all_true( bits, b->bit_count );
+    }
 
     *byte_count = n;
@@ -181 +183 @@
 
 static void
-tr_bitfieldEnsureBitsAlloced( tr_bitfield * b, size_t nth )
+tr_bitfieldEnsureBitsAlloced( tr_bitfield * b, size_t n )
 {
     size_t bytes_needed;
@@ -187 +189 @@
 
     if( has_all )
-        bytes_needed = get_bytes_needed( MAX( nth, b->true_count ) + 1 );
+        bytes_needed = get_bytes_needed( MAX( n, b->true_count ) );
     else
-        bytes_needed = get_bytes_needed( nth + 1 );
+        bytes_needed = get_bytes_needed( n );
 
     if( b->alloc_count < bytes_needed )
@@ -200 +202 @@
             set_all_true( b->bits, b->true_count );
     }
+}
+
+static void
+tr_bitfieldEnsureNthBitAlloced( tr_bitfield * b, size_t nth )
+{
+    /* count is zero-based, so we need to allocate nth+1 bits before setting the nth */
+    tr_bitfieldEnsureBitsAlloced( b, nth + 1 );
 }
 
@@ -333 +342 @@
     if( !tr_bitfieldHas( b, nth ) )
     {
-        tr_bitfieldEnsureBitsAlloced( b, nth );
+        tr_bitfieldEnsureNthBitAlloced( b, nth );
         b->bits[nth >> 3u] |= ( 0x80 >> ( nth & 7u ) );
         tr_bitfieldIncTrueCount( b, 1 );
@@ -359 +368 @@
     em = 0xff << ( 7 - ( end & 7 ) );
 
-    tr_bitfieldEnsureBitsAlloced( b, end );
+    tr_bitfieldEnsureNthBitAlloced( b, end );
     if( sb == eb )
     {
@@ -382 +391 @@
     if( !tr_bitfieldHas( b, nth ) )
     {
-        tr_bitfieldEnsureBitsAlloced( b, nth );
+        tr_bitfieldEnsureNthBitAlloced( b, nth );
         b->bits[nth >> 3u] &= ( 0xff7f >> ( nth & 7u ) );
         tr_bitfieldIncTrueCount( b, -1 );
@@ -409 +418 @@
     em = ~( 0xff << ( 7 - ( end & 7 ) ) );
 
-    tr_bitfieldEnsureBitsAlloced( b, end );
+    tr_bitfieldEnsureNthBitAlloced( b, end );
     if( sb == eb )
     {