diff options
author | Tim Pepper <timothy.c.pepper@linux.intel.com> | 2012-09-14 13:33:55 -0700 |
---|---|---|
committer | Tim Pepper <timothy.c.pepper@linux.intel.com> | 2012-09-14 13:33:55 -0700 |
commit | ccfb139a220cc8da2092198a409626d89c4c3667 (patch) | |
tree | 7647bba595976d53eca059cf89eb12a4b4b83024 | |
parent | 6a4bdee6efac6ebe98763d97d705ab6455cc4990 (diff) | |
download | corewatcher-ccfb139a220cc8da2092198a409626d89c4c3667.tar.gz corewatcher-ccfb139a220cc8da2092198a409626d89c4c3667.tar.bz2 corewatcher-ccfb139a220cc8da2092198a409626d89c4c3667.zip |
Fix apparent possible memory overrun in processing_queue
The queue is a simple array of strings of size defined by:
#define MAX_PROCESSING_OOPS 10
but the add_to / remove_from functions were hard coded to wrap the tail and
head array indices at 100.
Signed-off-by: Tim Pepper <timothy.c.pepper@linux.intel.com>
-rw-r--r-- | src/coredump.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/coredump.c b/src/coredump.c index 8325250..df9e70c 100644 --- a/src/coredump.c +++ b/src/coredump.c @@ -461,7 +461,7 @@ static void remove_from_processing_queue(void) free(processing_queue[head]); processing_queue[head++] = NULL; - if (head == 100) + if (head == MAX_PROCESSING_OOPS) head = 0; } @@ -692,7 +692,7 @@ static int add_to_processing(char *fullpath) g_hash_table_insert(core_status.processing_oops, c2, c2); processing_queue[tail++] = fp; - if (tail == 100) + if (tail == MAX_PROCESSING_OOPS) tail = 0; pthread_mutex_unlock(&processing_queue_mtx); |