PR# 14585 Exget can return address past end of chunk if stack_extend has to get urgent chunk

Problem Report Summary
Submitter: prestoat2000
Category: Runtime
Priority: Medium
Date: 2008/07/15
Class: Bug
Severity: Serious
Number: 14585
Release: 6.2.75753
Confidential: No
Status: Open
Responsible: manus_eiffel
Environment: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.8.1.13) Gecko/20080328 Firefox/2.0.0.13 Solaris 10 on SPARC
Synopsis: Exget can return address past end of chunk if stack_extend has to get urgent chunk

Description
Based on code inspection only, it appears that `stack_extend' in except.c
may return a chunk whose space (excluding chunk header) is not a multiple of
sizeof(struct ex_vect).  If `stack_extend' has to get an urgent chunk, it
just uses the size of the chunk, which I don't think is guaranteed to be
a multiple of sizeof(struct ex_vect) after subtracting sizeof(struct stxchunk).
It seems to me that in this case, `stack_extend' needs to adjust `size'
to a possibly smaller value, so that 

   size == sizeof(struct stxchunk) + N * sizeof(struct ex_vect)

for some integer N, before computing chunk->sk_end and stk->st_end.  
Otherwise, the test in exget

   if (stk->st_end == top) {

will never be true and exget will just keep allocating new execution vectors
past the end of the chunk, which is a Bad Thing (TM).

Note also that the constant URGENT_CHUNK is currently defined to be 1016 in
rt_urgent.h.  The comment says that this size is "1K with overhead".
Since overhead is now usually 16 bytes, this is incorrect.  Either change the
comment or compute the value for URGENT_CHUNK based on OVERHEAD.
To Reproduce

										
Problem Report Interactions