apr-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From roo...@apache.org
Subject svn commit: r372426 - /apr/apr/branches/1.2.x/memory/unix/apr_pools.c
Date Thu, 26 Jan 2006 04:18:03 GMT
Author: rooneg
Date: Wed Jan 25 20:18:02 2006
New Revision: 372426

URL: http://svn.apache.org/viewcvs?rev=372426&view=rev
Log:
Merge r328355 into 1.2.x.

Original log message:

* memory/unix/apr_pools.c (pool_clear_debug): Scribble over blocks
with a poison byte before freeing them to help highlight
use-after-free bugs.

Modified:
    apr/apr/branches/1.2.x/memory/unix/apr_pools.c

Modified: apr/apr/branches/1.2.x/memory/unix/apr_pools.c
URL: http://svn.apache.org/viewcvs/apr/apr/branches/1.2.x/memory/unix/apr_pools.c?rev=372426&r1=372425&r2=372426&view=diff
==============================================================================
--- apr/apr/branches/1.2.x/memory/unix/apr_pools.c (original)
+++ apr/apr/branches/1.2.x/memory/unix/apr_pools.c Wed Jan 25 20:18:02 2006
@@ -1355,6 +1355,8 @@
  * Pool creation/destruction (debug)
  */
 
+#define POOL_POISON_BYTE 'A'
+
 static void pool_clear_debug(apr_pool_t *pool, const char *file_line)
 {
     debug_node_t *node;
@@ -1382,13 +1384,18 @@
     /* Clear the user data. */
     pool->user_data = NULL;
 
-    /* Free the blocks */
+    /* Free the blocks, scribbling over them first to help highlight
+     * use-after-free issues. */
     while ((node = pool->nodes) != NULL) {
         pool->nodes = node->next;
 
-        for (index = 0; index < node->index; index++)
+        for (index = 0; index < node->index; index++) {
+            memset(node->beginp[index], POOL_POISON_BYTE,
+                   node->endp[index] - node->beginp[index]);
             free(node->beginp[index]);
+        }
 
+        memset(node, POOL_POISON_BYTE, SIZEOF_DEBUG_NODE_T);
         free(node);
     }
 



Mime
View raw message