You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2009/05/13 20:58:29 UTC
svn commit: r774491 - /httpd/httpd/trunk/modules/mem/mod_sharedmem.c
Author: jim
Date: Wed May 13 18:58:28 2009
New Revision: 774491
URL: http://svn.apache.org/viewvc?rev=774491&view=rev
Log:
Bounds check... id can't be >= number of slots (0 indexing)
Modified:
httpd/httpd/trunk/modules/mem/mod_sharedmem.c
Modified: httpd/httpd/trunk/modules/mem/mod_sharedmem.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mem/mod_sharedmem.c?rev=774491&r1=774490&r2=774491&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/mem/mod_sharedmem.c (original)
+++ httpd/httpd/trunk/modules/mem/mod_sharedmem.c Wed May 13 18:58:28 2009
@@ -433,7 +433,7 @@
if (!slot) {
return APR_ENOSHMAVAIL;
}
- if (id < 0 || id > slot->num) {
+ if (id < 0 || id >= slot->num) {
return APR_ENOSHMAVAIL;
}
@@ -457,8 +457,8 @@
}
inuse = (slot->base + (slot->size * slot->num));
- if (!inuse[id]) {
- return APR_ENOSHMAVAIL;
+ if (id >= slot->num || !inuse[id] ) {
+ return APR_NOTFOUND;
}
ret = slotmem_mem(slot, id, &ptr);
if (ret != APR_SUCCESS) {
@@ -480,8 +480,8 @@
}
inuse = (slot->base + (slot->size * slot->num));
- if (!inuse[id]) {
- return APR_ENOSHMAVAIL;
+ if (id >= slot->num || !inuse[id] ) {
+ return APR_NOTFOUND;
}
ret = slotmem_mem(slot, id, &ptr);
if (ret != APR_SUCCESS) {
@@ -541,9 +541,9 @@
inuse = (slot->base + (slot->size * slot->num));
SLOTMEM_LOCK(slot->smutex);
- if (!inuse[id]) {
+ if (id >= slot->num || !inuse[id] ) {
SLOTMEM_UNLOCK(slot->smutex);
- return APR_ENOSHMAVAIL;
+ return APR_NOTFOUND;
}
inuse[id] = 0;
SLOTMEM_UNLOCK(slot->smutex);