8:36 p.m.
The loop iteration over the 'bits' array in l_uintset_isempty()
exceeded the maximum offset for the given l_uintset, resulting in
out-of-bounds bits being considered for emptiness. Add a test that
demonstrates the problem, and correct the maximum offset when
iterating over the l_uintset 'bits' field.
Ossama Othman (2):
unit: Add l_uintset_isempty() test
uintset: Do not exceed max offset in empty check
ell/uintset.c | 5 ++++-
unit/test-uintset.c | 17 +++++++++++++++++
2 files changed, 21 insertions(+), 1 deletion(-)
--
2.20.1
8:36 p.m.
New subject: [PATCH 1/2] unit: Add l_uintset_isempty() test
---
unit/test-uintset.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/unit/test-uintset.c b/unit/test-uintset.c
index 99888b3..3c9790e 100644
--- a/unit/test-uintset.c
+++ b/unit/test-uintset.c
@@ -347,6 +347,22 @@ static void test_uintset_intersect_test(const void *user_data)
l_uintset_free(set_r);
}
+static void test_uintset_isempty(const void *user_data)
+{
+ struct l_uintset *a = NULL;
+ struct l_uintset *b = l_uintset_new(32);
+ struct l_uintset *c = l_uintset_new(32);
+
+ assert(l_uintset_put(c, 10));
+
+ assert(l_uintset_isempty(a));
+ assert(l_uintset_isempty(b));
+ assert(!l_uintset_isempty(c));
+
+ l_uintset_free(c);
+ l_uintset_free(b);
+}
+
int main(int argc, char *argv[])
{
l_test_init(&argc, &argv);
@@ -364,6 +380,7 @@ int main(int argc, char *argv[])
&intersect_data_1);
l_test_add("l_uintset intersect test 2", test_uintset_intersect_test,
&intersect_data_2);
+ l_test_add("l_uintset isempty", test_uintset_isempty, NULL);
return l_test_run();
}
--
2.20.1
8:36 p.m.
New subject: [PATCH 2/2] uintset: Do not exceed max offset in empty check
Do not exceed the maximum l_uintset bits offset when checking if the
set is empty.
---
ell/uintset.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/ell/uintset.c b/ell/uintset.c
index 50119a0..b88e28e 100644
--- a/ell/uintset.c
+++ b/ell/uintset.c
@@ -516,11 +516,14 @@ LIB_EXPORT struct l_uintset *l_uintset_intersect(const struct
l_uintset *set_a,
LIB_EXPORT bool l_uintset_isempty(const struct l_uintset *set)
{
uint16_t i;
+ uint32_t offset_max;
if (unlikely(!set))
return true;
- for (i = 0; i < set->size; i++) {
+ offset_max = (set->size + BITS_PER_LONG - 1) / BITS_PER_LONG;
+
+ for (i = 0; i < offset_max; i++) {
if (set->bits[i])
return false;
}
--
2.20.1
8:43 p.m.
Hi Ossama,
On 9/16/19 3:36 PM, Ossama Othman wrote:
The loop iteration over the 'bits' array in
l_uintset_isempty()
exceeded the maximum offset for the given l_uintset, resulting in
out-of-bounds bits being considered for emptiness. Add a test that
demonstrates the problem, and correct the maximum offset when
iterating over the l_uintset 'bits' field.
Ossama Othman (2):
unit: Add l_uintset_isempty() test
uintset: Do not exceed max offset in empty check
ell/uintset.c | 5 ++++-
unit/test-uintset.c | 17 +++++++++++++++++
2 files changed, 21 insertions(+), 1 deletion(-)
Nice catch, both applied.
Regards,
-Denis
1067
days inactive
1067
days old
3 comments
2 participants
participants (2)
-
Denis Kenzior -
Ossama Othman