shithub: riscv

Info  •  Files  •  Log  •  Branches

libpanel: fix memory corruption bug in plinitentry(), add pl_erealloc()

--- a/sys/src/cmd/mothra/libpanel/entry.c

+++ b/sys/src/cmd/mothra/libpanel/entry.c

@@ -34,8 +34,7 @@

 	ep=p->data;

 	n=ep->entp-ep->entry;

 	m=strlen(s);

-	if((e=realloc(ep->entry,n+m+SLACK))==0)

-		return;

+	e=pl_erealloc(ep->entry,n+m+SLACK);

 	ep->entry=e;

 	e+=n;

 	strncpy(e, s, m);

@@ -131,11 +130,7 @@

 		ep->entp+=runetochar(ep->entp, &c);

 		if(ep->entp>ep->eent){

 			n=ep->entp-ep->entry;

-			ep->entry=realloc(ep->entry, n+100+SLACK);

-			if(ep->entry==0){

-				fprint(2, "can't realloc in pl_typeentry\n");

-				exits("no mem");

-			}

+			ep->entry=pl_erealloc(ep->entry, n+100+SLACK);

 			ep->entp=ep->entry+n;

 			ep->eent=ep->entp+100;

 		}

@@ -155,7 +150,7 @@

 	Entry *ep;

 	ep = p->data;

 	free(ep->entry);

-	ep->entry = ep->eent = 0;

+	ep->entry = ep->eent = ep->entp = 0;

 }

 void plinitentry(Panel *v, int flags, int wid, char *str, void (*hit)(Panel *, char *)){

 	int elen;

@@ -174,8 +169,7 @@

 	v->paste=pl_pasteentry;

 	elen=100;

 	if(str) elen+=strlen(str);

-	if(ep->entry==nil)

-		ep->entry=pl_emalloc(elen+SLACK);

+	ep->entry=pl_erealloc(ep->entry, elen+SLACK);

 	ep->eent=ep->entry+elen;

 	strecpy(ep->entry, ep->eent, str ? str : "");

 	ep->entp=ep->entry+strlen(ep->entry);

--- a/sys/src/cmd/mothra/libpanel/mem.c

+++ b/sys/src/cmd/mothra/libpanel/mem.c

@@ -14,6 +14,16 @@

 	setmalloctag(v, getcallerpc(&n));

 	return v;

 }

+void *pl_erealloc(void *v, int n)

+{

+	v=realloc(v, n);

+	if(v==0){

+		fprint(2, "Can't realloc!\n");

+		exits("no mem");

+	}

+	setrealloctag(v, getcallerpc(&v));

+	return v;

+}

 void pl_unexpected(Panel *g, char *rou){

 	fprint(2, "%s called unexpectedly (%s %lux)\n", rou, g->kind, (ulong)g);

 	abort();

--- a/sys/src/cmd/mothra/libpanel/pldefs.h

+++ b/sys/src/cmd/mothra/libpanel/pldefs.h

@@ -45,6 +45,7 @@

 };

 Panel *pl_newpanel(Panel *, int);	/* make a new Panel, given parent & data size */

 void *pl_emalloc(int);			/* allocate some space, exit on error */

+void *pl_erealloc(void*,int);		/* reallocate some space, exit on error */

 void pl_print(Panel *);			/* print a Panel tree */

 Panel *pl_ptinpanel(Point, Panel *);	/* highest-priority subpanel containing point */

 /*

--- a/sys/src/cmd/mothra/libpanel/rtext.c

+++ b/sys/src/cmd/mothra/libpanel/rtext.c

@@ -302,8 +302,7 @@

 		n = strlen(w->text)+64;

 		if(p+n >= e){

 			n = (p+n+64)-b;

-			if((t = realloc(b, n))==0)

-				break;

+			t = pl_erealloc(b, n);

 			p = t+(p-b);

 			e = t+n;

 			b = t;

--- a/sys/src/cmd/mothra/libpanel/snarf.c

+++ b/sys/src/cmd/mothra/libpanel/snarf.c

@@ -17,7 +17,7 @@

 }

 char *plgetsnarf(void){

 	int fd, n, r;

-	char *s, *x;

+	char *s;

 	if((fd=open("/dev/snarf", OREAD))<0)

 		return nil;

@@ -24,9 +24,7 @@

 	n=0;

 	s=nil;

 	for(;;){

-		if((x=realloc(s, n+1024))==0)

-			break;

-		s=x;

+		s=pl_erealloc(s, n+1024);

 		if((r = read(fd, s+n, 1024)) <= 0)

 			break;

 		n += r;

--- a/sys/src/cmd/mothra/libpanel/textwin.c

+++ b/sys/src/cmd/mothra/libpanel/textwin.c

@@ -66,11 +66,7 @@

 	int nloc;

 	if(l>=t->eloc-t->loc){

 		nloc=l+SLACK;

-		t->loc=realloc(t->loc, nloc*sizeof(Point));

-		if(t->loc==0){

-			fprint(2, "No mem in tw_storeloc\n");

-			exits("no mem");

-		}

+		t->loc=pl_erealloc(t->loc, nloc*sizeof(Point));

 		t->eloc=t->loc+nloc;

 	}

 	t->loc[l]=p;

@@ -390,16 +386,13 @@

  */

 void twreplace(Textwin *t, int r0, int r1, Rune *ins, int nins){

 	int olen, nlen, tlen, dtop;

-	Rune *ntext;

 	olen=t->etext-t->text;

 	nlen=olen+nins-(r1-r0);

 	tlen=t->eslack-t->text;

 	if(nlen>tlen){

 		tlen=nlen+SLACK;

-		if((ntext=realloc(t->text, tlen*sizeof(Rune)))==0)

-			return;

-		t->text=ntext;

-		t->eslack=ntext+tlen;

+		t->text=pl_erealloc(t->text, tlen*sizeof(Rune));

+		t->eslack=t->text+tlen;

 	}

 	if(olen!=nlen)

 		memmove(t->text+r0+nins, t->text+r1, (olen-r1)*sizeof(Rune));

-- 

⑨