Skip to content
Snippets Groups Projects
  1. Nov 21, 2012
  2. Nov 20, 2012
  3. Nov 19, 2012
  4. Nov 13, 2012
  5. Nov 08, 2012
  6. Nov 05, 2012
  7. Nov 02, 2012
  8. Oct 25, 2012
  9. Oct 23, 2012
  10. Oct 22, 2012
  11. Oct 20, 2012
  12. Oct 19, 2012
  13. Oct 18, 2012
    • Konstantin Osipov's avatar
      A fix for an ugly bug with memory corruption in the new output buffer. · af0a635a
      Konstantin Osipov authored
      coio_writev() could modify the passed parameter in case of a
      partial write.
      
      It would corrupt struct obuf, which would pass to coio_writev()
      a pointer to a vector whose iov_base pointers were later reused.
      
      The following would happen:
      - iobuf_flush() would pass obuf->iov to coio_writev
      - coio_writev would advance one or two iov_base pointers
      - capacity value would hence become meaningless, and a subsequent
      obuf_dup() would overwrite heap memory
      - we would get a memory corruption in some place very distant
      from where the problem originally occurred.
      
      The fix is to preserve iovec values in coio_writev.
      This is implemented by keeping a copy of the changed iovec
      and restoring the original iovec value at exit from
      coio_writev.
      af0a635a
Loading