[Emacs-diffs] Changes to emacs/src/alloc.c

[Jan Djärv]

Index: emacs/src/alloc.c
diff -c emacs/src/alloc.c:1.357 emacs/src/alloc.c:1.358
*** emacs/src/alloc.c:1.357     Tue Dec 21 11:30:31 2004
--- emacs/src/alloc.c   Sat Dec 25 10:13:57 2004
***************
*** 601,606 ****
--- 601,625 ----
           ((unsigned)(ptr[-4]) << 24))
  
  
+ /* The call depth in overrun_check  functions.  Realloc may call both malloc
+    and free.  If realloc calls malloc, this may happen:
+    overrun_check_realloc()
+       -> malloc -> (via hook)_-> emacs_blocked_malloc
+          -> overrun_check_malloc
+             call malloc  (hooks are NULL, so real malloc is called).
+             malloc returns 10000.
+             add overhead, return 10016.
+       <- (back in overrun_check_realloc)
+       add overhead again, return 10032
+ 
+    (time passes).
+ 
+    overrun_check_free(10032)
+      decrease overhed
+      free(10016)  <-  crash, because 10000 is the original pointer.  */
+ 
+ static int check_depth;
+ 
  /* Like malloc, but wraps allocated block with header and trailer.  */
  
  POINTER_TYPE *
***************
*** 608,622 ****
       size_t size;
  {
    register unsigned char *val;
  
!   val = (unsigned char *) malloc (size + XMALLOC_OVERRUN_CHECK_SIZE*2);
!   if (val)
      {
        bcopy (xmalloc_overrun_check_header, val, XMALLOC_OVERRUN_CHECK_SIZE - 
4);
        val += XMALLOC_OVERRUN_CHECK_SIZE;
        XMALLOC_PUT_SIZE(val, size);
        bcopy (xmalloc_overrun_check_trailer, val + size, 
XMALLOC_OVERRUN_CHECK_SIZE);
      }
    return (POINTER_TYPE *)val;
  }
  
--- 627,643 ----
       size_t size;
  {
    register unsigned char *val;
+   size_t overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_SIZE*2 : 0;
  
!   val = (unsigned char *) malloc (size + overhead);
!   if (val && check_depth == 1)
      {
        bcopy (xmalloc_overrun_check_header, val, XMALLOC_OVERRUN_CHECK_SIZE - 
4);
        val += XMALLOC_OVERRUN_CHECK_SIZE;
        XMALLOC_PUT_SIZE(val, size);
        bcopy (xmalloc_overrun_check_trailer, val + size, 
XMALLOC_OVERRUN_CHECK_SIZE);
      }
+   --check_depth;
    return (POINTER_TYPE *)val;
  }
  
***************
*** 630,637 ****
--- 651,660 ----
       size_t size;
  {
    register unsigned char *val = (unsigned char *)block;
+   size_t overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_SIZE*2 : 0;
  
    if (val
+       && check_depth == 1
        && bcmp (xmalloc_overrun_check_header,
               val - XMALLOC_OVERRUN_CHECK_SIZE,
               XMALLOC_OVERRUN_CHECK_SIZE - 4) == 0)
***************
*** 646,660 ****
        bzero (val, XMALLOC_OVERRUN_CHECK_SIZE);
      }
  
!   val = (unsigned char *) realloc ((POINTER_TYPE *)val, size + 
XMALLOC_OVERRUN_CHECK_SIZE*2);
  
!   if (val)
      {
        bcopy (xmalloc_overrun_check_header, val, XMALLOC_OVERRUN_CHECK_SIZE - 
4);
        val += XMALLOC_OVERRUN_CHECK_SIZE;
        XMALLOC_PUT_SIZE(val, size);
        bcopy (xmalloc_overrun_check_trailer, val + size, 
XMALLOC_OVERRUN_CHECK_SIZE);
      }
    return (POINTER_TYPE *)val;
  }
  
--- 669,684 ----
        bzero (val, XMALLOC_OVERRUN_CHECK_SIZE);
      }
  
!   val = (unsigned char *) realloc ((POINTER_TYPE *)val, size + overhead);
  
!   if (val && check_depth == 1)
      {
        bcopy (xmalloc_overrun_check_header, val, XMALLOC_OVERRUN_CHECK_SIZE - 
4);
        val += XMALLOC_OVERRUN_CHECK_SIZE;
        XMALLOC_PUT_SIZE(val, size);
        bcopy (xmalloc_overrun_check_trailer, val + size, 
XMALLOC_OVERRUN_CHECK_SIZE);
      }
+   --check_depth;
    return (POINTER_TYPE *)val;
  }
  
***************
*** 666,672 ****
--- 690,698 ----
  {
    unsigned char *val = (unsigned char *)block;
  
+   ++check_depth;
    if (val
+       && check_depth == 1
        && bcmp (xmalloc_overrun_check_header,
               val - XMALLOC_OVERRUN_CHECK_SIZE,
               XMALLOC_OVERRUN_CHECK_SIZE - 4) == 0)
***************
*** 682,687 ****
--- 708,714 ----
      }
  
    free (val);
+   --check_depth;
  }
  
  #undef malloc