You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@apr.apache.org by Jon Travis <jt...@p00p.org> on 2001/03/09 01:39:44 UTC
[PATCH: apr_hash.c]
apr_hash.c has a very obscure bug in it, though I'm very surprised nobody
has been bitten by it before. It is possible, when expanding the table,
to use an old pointer and overwrite the hash entry value upon return from
find_entry. Anyway, this small patch fixes it. I have a testhash.c for
the tests directory as well, if anyone thinks we need it.
-- Jon
Index: apr_hash.c
===================================================================
RCS file: /home/cvspublic/apr/tables/apr_hash.c,v
retrieving revision 1.16
diff -u -u -r1.16 apr_hash.c
--- apr_hash.c 2001/03/07 17:57:19 1.16
+++ apr_hash.c 2001/03/09 00:32:27
@@ -275,10 +275,7 @@
he->klen = klen;
he->val = val;
*hep = he;
- /* check that the collision rate isn't too high */
- if (++ht->count > ht->max) {
- expand_array(ht);
- }
+ ht->count++;
return hep;
}
@@ -310,6 +307,10 @@
else {
/* replace entry */
(*hep)->val = val;
+ /* check that the collision rate isn't too high */
+ if (ht->count > ht->max) {
+ expand_array(ht);
+ }
}
}
/* else key not present and val==NULL */
Re: [PATCH: apr_hash.c]
Posted by rb...@covalent.net.
Committed, thanks.
Ryan
On Thu, 8 Mar 2001, Jon Travis wrote:
> apr_hash.c has a very obscure bug in it, though I'm very surprised nobody
> has been bitten by it before. It is possible, when expanding the table,
> to use an old pointer and overwrite the hash entry value upon return from
> find_entry. Anyway, this small patch fixes it. I have a testhash.c for
> the tests directory as well, if anyone thinks we need it.
>
> -- Jon
>
>
>
> Index: apr_hash.c
> ===================================================================
> RCS file: /home/cvspublic/apr/tables/apr_hash.c,v
> retrieving revision 1.16
> diff -u -u -r1.16 apr_hash.c
> --- apr_hash.c 2001/03/07 17:57:19 1.16
> +++ apr_hash.c 2001/03/09 00:32:27
> @@ -275,10 +275,7 @@
> he->klen = klen;
> he->val = val;
> *hep = he;
> - /* check that the collision rate isn't too high */
> - if (++ht->count > ht->max) {
> - expand_array(ht);
> - }
> + ht->count++;
> return hep;
> }
>
> @@ -310,6 +307,10 @@
> else {
> /* replace entry */
> (*hep)->val = val;
> + /* check that the collision rate isn't too high */
> + if (ht->count > ht->max) {
> + expand_array(ht);
> + }
> }
> }
> /* else key not present and val==NULL */
>
>
_______________________________________________________________________________
Ryan Bloom rbb@apache.org
406 29th St.
San Francisco, CA 94131
-------------------------------------------------------------------------------