PR# 14585 Exget can return address past end of chunk if stack_extend has to get urgent chunk
Problem Report Summary
Submitter: prestoat2000
Category: Runtime
Priority: Medium
Date: 2008/07/15
Class: Bug
Severity: Serious
Number: 14585
Release: 6.2.75753
Confidential: No
Status: Open
Responsible: manus_eiffel
Environment: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.8.1.13) Gecko/20080328 Firefox/2.0.0.13
Solaris 10 on SPARC
Synopsis: Exget can return address past end of chunk if stack_extend has to get urgent chunk
Description
Based on code inspection only, it appears that `stack_extend' in except.c may return a chunk whose space (excluding chunk header) is not a multiple of sizeof(struct ex_vect). If `stack_extend' has to get an urgent chunk, it just uses the size of the chunk, which I don't think is guaranteed to be a multiple of sizeof(struct ex_vect) after subtracting sizeof(struct stxchunk). It seems to me that in this case, `stack_extend' needs to adjust `size' to a possibly smaller value, so that size == sizeof(struct stxchunk) + N * sizeof(struct ex_vect) for some integer N, before computing chunk->sk_end and stk->st_end. Otherwise, the test in exget if (stk->st_end == top) { will never be true and exget will just keep allocating new execution vectors past the end of the chunk, which is a Bad Thing (TM). Note also that the constant URGENT_CHUNK is currently defined to be 1016 in rt_urgent.h. The comment says that this size is "1K with overhead". Since overhead is now usually 16 bytes, this is incorrect. Either change the comment or compute the value for URGENT_CHUNK based on OVERHEAD.
To Reproduce
Problem Report Interactions