examples/performance-thread: fix out-of-bounds tls array
authorSlawomir Mrozowicz <slawomirx.mrozowicz@intel.com>
Wed, 20 Sep 2017 08:20:24 +0000 (10:20 +0200)
committerThomas Monjalon <thomas@monjalon.net>
Fri, 13 Oct 2017 23:22:29 +0000 (01:22 +0200)
Overrunning array per_lcore_this_sched->current_lthread->tls->data of
1024 8-byte elements at element index 1024 using index k.
Fixed by correct check k condition.

Coverity issue: 143462, 143463
Fixes: 116819b9ed0d ("examples/performance-thread: add lthread subsystem")

Signed-off-by: Slawomir Mrozowicz <slawomirx.mrozowicz@intel.com>
Acked-by: Michal Jastrzebski <michalx.k.jastrzebski@intel.com>
examples/performance-thread/common/lthread_tls.c

index 47505f2..56f0c2f 100644 (file)
@@ -198,11 +198,12 @@ void _lthread_tls_destroy(struct lthread *lt)
 void
 *lthread_getspecific(unsigned int k)
 {
+       void *res = NULL;
 
-       if (k > LTHREAD_MAX_KEYS)
-               return NULL;
+       if (k < LTHREAD_MAX_KEYS)
+               res = THIS_LTHREAD->tls->data[k];
 
-       return THIS_LTHREAD->tls->data[k];
+       return res;
 }
 
 /*
@@ -212,7 +213,7 @@ void
  */
 int lthread_setspecific(unsigned int k, const void *data)
 {
-       if (k > LTHREAD_MAX_KEYS)
+       if (k >= LTHREAD_MAX_KEYS)
                return POSIX_ERRNO(EINVAL);
 
        int n = THIS_LTHREAD->tls->nb_keys_inuse;