You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2009/05/13 20:58:29 UTC

svn commit: r774491 - /httpd/httpd/trunk/modules/mem/mod_sharedmem.c

Author: jim
Date: Wed May 13 18:58:28 2009
New Revision: 774491

URL: http://svn.apache.org/viewvc?rev=774491&view=rev
Log:
Bounds check... id can't be >= number of slots (0 indexing)

Modified:
    httpd/httpd/trunk/modules/mem/mod_sharedmem.c

Modified: httpd/httpd/trunk/modules/mem/mod_sharedmem.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mem/mod_sharedmem.c?rev=774491&r1=774490&r2=774491&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/mem/mod_sharedmem.c (original)
+++ httpd/httpd/trunk/modules/mem/mod_sharedmem.c Wed May 13 18:58:28 2009
@@ -433,7 +433,7 @@
     if (!slot) {
         return APR_ENOSHMAVAIL;
     }
-    if (id < 0 || id > slot->num) {
+    if (id < 0 || id >= slot->num) {
         return APR_ENOSHMAVAIL;
     }
 
@@ -457,8 +457,8 @@
     }
 
     inuse = (slot->base + (slot->size * slot->num));
-    if (!inuse[id]) {
-        return APR_ENOSHMAVAIL;
+    if (id >= slot->num || !inuse[id] ) {
+        return APR_NOTFOUND;
     }
     ret = slotmem_mem(slot, id, &ptr);
     if (ret != APR_SUCCESS) {
@@ -480,8 +480,8 @@
     }
 
     inuse = (slot->base + (slot->size * slot->num));
-    if (!inuse[id]) {
-        return APR_ENOSHMAVAIL;
+    if (id >= slot->num || !inuse[id] ) {
+        return APR_NOTFOUND;
     }
     ret = slotmem_mem(slot, id, &ptr);
     if (ret != APR_SUCCESS) {
@@ -541,9 +541,9 @@
     inuse = (slot->base + (slot->size * slot->num));
 
     SLOTMEM_LOCK(slot->smutex);
-    if (!inuse[id]) {
+    if (id >= slot->num || !inuse[id] ) {
         SLOTMEM_UNLOCK(slot->smutex);
-        return APR_ENOSHMAVAIL;
+        return APR_NOTFOUND;
     }
     inuse[id] = 0;
     SLOTMEM_UNLOCK(slot->smutex);