Changeset 11275 in vbox for trunk/src/libs/xpcom18a4/xpcom

Timestamp:

Aug 8, 2008 7:41:13 PM (16 years ago)

Author:

vboxsync

Message:

xpcom/PL_DHashTableEnumerate: Fixed access to freed memory in VBoxSVC during ipcDConnectService::OnClientStateChange() / ipcDConnectService::DeleteInstance(). The enumerator callback is probably violating some precondition, but we might be better off making PL_DHashTableEnumerate just deal with this instead.

File:

• trunk/src/libs/xpcom18a4/xpcom/ds/pldhash.c (modified) (2 diffs)

trunk/src/libs/xpcom18a4/xpcom/ds/pldhash.c

@@ -607 +607 @@
     PLDHashEntryHdr *entry;
     PLDHashOperator op;
-
+#ifdef VBOX
+    PRUint32 generation;
+    char *entryStore;
+
+    generation = table->generation;
+    entryStore = table->entryStore;
+#endif
     entryAddr = table->entryStore;
     entrySize = table->entrySize;
@@ -618 +624 @@
         if (ENTRY_IS_LIVE(entry)) {
             op = etor(table, entry, i++, arg);
+#ifdef VBOX
+            /*
+             * Adjust pointers if entryStore was reallocated as a result
+             * of an add or remove performed by the enumerator. It is
+             * probably not supposed to do this, but since it does we'll
+             * simply deal with it.
+             *
+             * This happens during ipcDConnectService::OnClientStateChange()
+             * / ipcDConnectService::DeleteInstance() now.
+             */
+            if (generation != table->generation)
+            {
+                entryAddr += table->entryStore - entryStore;
+                entryStore = table->entryStore;
+                entry = (PLDHashEntryHdr *)entryAddr;
+                capacity = PL_DHASH_TABLE_SIZE(table);
+                entryLimit = table->entryStore + capacity * entrySize;
+            }
+
+#endif
             if (op & PL_DHASH_REMOVE) {
                 METER(table->stats.removeEnums++);