From c5a489d7f82535a70488dd4f9e40e79f32a7fb2f Mon Sep 17 00:00:00 2001 From: peter Date: Sun, 4 Oct 2026 17:04:28 +0000 Subject: Fix the crashes found by the fuzzer so far. I really need to think of a better way to store those crash inputs. FossilOrigin-Name: a8b84fbc85ec0b472aca930d2d0af27949b39940317114cc37d37044bf1975d5 --- src/lib/memory.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) (limited to 'src/lib/memory.c') diff --git a/src/lib/memory.c b/src/lib/memory.c index a8317c7..006c409 100644 --- a/src/lib/memory.c +++ b/src/lib/memory.c @@ -441,8 +441,7 @@ compact(struct aplwc *aplwc) static void * alloc(struct aplwc *aplwc, size_t size, enum chunk_tag tag) { - struct chunk *free; - struct chunk *new; + struct chunk *free, *new; size_t pad; int attempt; @@ -454,7 +453,7 @@ alloc(struct aplwc *aplwc, size_t size, enum chunk_tag tag) attempt = 0; retry: DEBUG(check_mem(aplwc)); - free = FAILCASE(find_free(aplwc, size), NULL); + new = free = FAILCASE(find_free(aplwc, size), NULL); if(!free){ switch(attempt++){ case 0: @@ -469,14 +468,12 @@ retry: /* fall-through */ default: aplwc->last_error = APLWC_OUT_OF_MEMORY; - return NULL; + goto end; } } assert(free->tag == CHUNK_TAG_FREE); - new = free; - if(free->size > (size + 2*HEADER_SIZE)){ free = (struct chunk *)(((uint8_t*)free) + HEADER_SIZE + size); free->tag = CHUNK_TAG_FREE; @@ -496,8 +493,9 @@ retry: new->tag = tag; new->reachable = aplwc->reachable_bit; +end: DEBUG(check_mem(aplwc)); - return data(new); + return new ? data(new) : NULL; } void -- cgit v1.2.3