Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Potential CSndUList array overflow #811

Merged
merged 2 commits into from
Aug 27, 2019
Merged

Potential CSndUList array overflow #811

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
47e5890
[core] Fixed sender list to reallocate on insert
maxsharabayko Aug 13, 2019
64875fa
[core] CSndUList initial size is reduced to 512 elements
maxsharabayko Aug 13, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 44 additions & 41 deletions srtcore/queue.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,7 @@ void CUnitQueue::makeUnitGood(CUnit * unit)

CSndUList::CSndUList():
m_pHeap(NULL),
m_iArrayLength(4096),
m_iArrayLength(512),
m_iLastEntry(-1),
m_ListLock(),
m_pWindowLock(NULL),
Expand All @@ -273,32 +273,6 @@ CSndUList::~CSndUList()
pthread_mutex_destroy(&m_ListLock);
}

void CSndUList::insert(int64_t ts, const CUDT* u)
{
CGuard listguard(m_ListLock);

// increase the heap array size if necessary
if (m_iLastEntry == m_iArrayLength - 1)
{
CSNode** temp = NULL;

try
{
temp = new CSNode*[m_iArrayLength * 2];
}
catch(...)
{
return;
}

memcpy(temp, m_pHeap, sizeof(CSNode*) * m_iArrayLength);
m_iArrayLength *= 2;
delete [] m_pHeap;
m_pHeap = temp;
}

insert_(ts, u);
}

void CSndUList::update(const CUDT* u, EReschedule reschedule)
{
Expand All @@ -319,6 +293,8 @@ void CSndUList::update(const CUDT* u, EReschedule reschedule)
}

remove_(u);
insert_norealloc_(1, u);
rndi marked this conversation as resolved.
Show resolved Hide resolved
return;
}

insert_(1, u);
Expand Down Expand Up @@ -366,7 +342,7 @@ int CSndUList::pop(sockaddr*& addr, CPacket& pkt)

// insert a new entry, ts is the next processing time
if (ts > 0)
insert_(ts, u);
insert_norealloc_(ts, u);

return 1;
}
Expand All @@ -388,14 +364,47 @@ uint64_t CSndUList::getNextProcTime()
return m_pHeap[0]->m_llTimeStamp_tk;
}


void CSndUList::realloc_()
{
CSNode** temp = NULL;

try
{
temp = new CSNode *[2 * m_iArrayLength];
}
catch (...)
{
throw CUDTException(MJ_SYSTEMRES, MN_MEMORY, 0);
}

memcpy(temp, m_pHeap, sizeof(CSNode*) * m_iArrayLength);
m_iArrayLength *= 2;
delete[] m_pHeap;
m_pHeap = temp;
}


void CSndUList::insert_(int64_t ts, const CUDT* u)
{
// increase the heap array size if necessary
if (m_iLastEntry == m_iArrayLength - 1)
realloc_();

insert_norealloc_(ts, u);
}


void CSndUList::insert_norealloc_(int64_t ts, const CUDT* u)
{
CSNode* n = u->m_pSNode;

// do not insert repeated node
if (n->m_iHeapLoc >= 0)
return;

SRT_ASSERT(m_iLastEntry < m_iArrayLength);

m_iLastEntry ++;
m_pHeap[m_iLastEntry] = n;
n->m_llTimeStamp_tk = ts;
Expand All @@ -405,16 +414,12 @@ void CSndUList::insert_(int64_t ts, const CUDT* u)
while (p != 0)
{
p = (q - 1) >> 1;
if (m_pHeap[p]->m_llTimeStamp_tk > m_pHeap[q]->m_llTimeStamp_tk)
{
CSNode* t = m_pHeap[p];
m_pHeap[p] = m_pHeap[q];
m_pHeap[q] = t;
t->m_iHeapLoc = q;
q = p;
}
else
break;
if (m_pHeap[p]->m_llTimeStamp_tk <= m_pHeap[q]->m_llTimeStamp_tk)
break;

swap(m_pHeap[p], m_pHeap[q]);
m_pHeap[q]->m_iHeapLoc = q;
q = p;
}

n->m_iHeapLoc = q;
Expand Down Expand Up @@ -452,10 +457,8 @@ void CSndUList::remove_(const CUDT* u)

if (m_pHeap[q]->m_llTimeStamp_tk > m_pHeap[p]->m_llTimeStamp_tk)
{
CSNode* t = m_pHeap[p];
m_pHeap[p] = m_pHeap[q];
swap(m_pHeap[p], m_pHeap[q]);
m_pHeap[p]->m_iHeapLoc = p;
m_pHeap[q] = t;
m_pHeap[q]->m_iHeapLoc = q;

q = p;
Expand Down
23 changes: 17 additions & 6 deletions srtcore/queue.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,12 +166,6 @@ friend class CSndQueue;

static EReschedule rescheduleIf(bool cond) { return cond ? DO_RESCHEDULE : DONT_RESCHEDULE; }

/// Insert a new UDT instance into the list.
/// @param [in] ts time stamp: next processing time
/// @param [in] u pointer to the UDT instance

void insert(int64_t ts, const CUDT* u);

/// Update the timestamp of the UDT instance on the list.
/// @param [in] u pointer to the UDT instance
/// @param [in] resechedule if the timestampe shoudl be rescheduled
Expand All @@ -196,7 +190,24 @@ friend class CSndQueue;
uint64_t getNextProcTime();

private:

/// Doubles the size of the list.
///
void realloc_();

/// Insert a new UDT instance into the list with realloc if required.
///
/// @param [in] ts time stamp: next processing time
/// @param [in] u pointer to the UDT instance
void insert_(int64_t ts, const CUDT* u);

/// Insert a new UDT instance into the list without realloc.
/// Should be called if there is a gauranteed space for the element.
///
/// @param [in] ts time stamp: next processing time
/// @param [in] u pointer to the UDT instance
void insert_norealloc_(int64_t ts, const CUDT* u);

void remove_(const CUDT* u);

private:
Expand Down