vppinfra: loop counter off by 1 in search_free_list() 45/28445/1
authorSteven Luong <sluong@cisco.com>
Thu, 7 May 2020 17:47:33 +0000 (10:47 -0700)
committerAndrew Yourtchenko <ayourtch@gmail.com>
Tue, 18 Aug 2020 09:54:56 +0000 (09:54 +0000)
commit0efdd24d0d406f9a4ea6817de3df3c4b08cd391c
tree30ccbf415b7edf70a7f1aa832e49b2ac6edcb90f
parentd63d353faa54b5a0a8724d7491c15331b5dcc006
vppinfra: loop counter off by 1 in search_free_list()

In search_free_list(), we have this do while loop.
do
  {
    l--;
    f_index = h->free_lists[b][l];
    f = elt_at (h, f_index);
    f_size = heap_elt_size (v, f);
    if ((s = f_size - size) >= 0)
      break;
  }
while (l >= 0);

When (l == 0), we still go back up to execute l--. Then l become -1. The
next statement is we index h->free_lists[b][-1]. After that, elt_at() would
probably cause a crash in the ASSERT.

Type: fix
Ticket: VPPSUPP-63

Signed-off-by: Steven Luong <sluong@cisco.com>
Change-Id: I617d122aa221cfdfe38f8be50f4e0f0e76e11bb5
(cherry picked from commit ec7012e51edef4aec2239cb5b3a249f46d9b2cb0)
src/vppinfra/heap.c