If a sizeclass in the metadata is corrupted, then this can be used to
force an index beyond the end of these tables. This extends the tables
to the next power of two, and uses a mask on the index, so they are
always either a valid piece of data, or zero.
This commit is contained in:
Matthew Parkinson 2019-01-21 17:44:09 +00:00
Родитель 94f8b886a0
Коммит bb5027b454
2 изменённых файлов: 27 добавлений и 6 удалений

Просмотреть файл

@ -1,5 +1,6 @@
#pragma once
#include "bits.h"
#include "flaglock.h"
namespace snmalloc
@ -30,4 +31,22 @@ namespace snmalloc
return obj;
}
};
template <size_t length, typename T>
class ModArray
{
static constexpr size_t rlength = bits::next_pow2_const(length);
T array[rlength];
public:
constexpr const T &operator[] (const size_t i) const
{
return array[i & (rlength - 1)];
}
constexpr T &operator[] (const size_t i)
{
return array[i & (rlength - 1)];
}
};
}

Просмотреть файл

@ -1,16 +1,17 @@
#pragma once
#include "superslab.h"
#include "../ds/helpers.h"
namespace snmalloc
{
struct SizeClassTable
{
size_t size[NUM_SIZECLASSES];
uint16_t bump_ptr_start[NUM_SMALL_CLASSES];
uint16_t short_bump_ptr_start[NUM_SMALL_CLASSES];
uint16_t count_per_slab[NUM_SMALL_CLASSES];
uint16_t medium_slab_slots[NUM_MEDIUM_CLASSES];
ModArray<NUM_SIZECLASSES, size_t> size;
ModArray<NUM_SMALL_CLASSES, uint16_t> bump_ptr_start;
ModArray<NUM_SMALL_CLASSES, uint16_t> short_bump_ptr_start;
ModArray<NUM_SMALL_CLASSES, uint16_t> count_per_slab;
ModArray<NUM_MEDIUM_CLASSES, uint16_t> medium_slab_slots;
constexpr SizeClassTable()
: size(),
@ -66,6 +67,7 @@ namespace snmalloc
constexpr static inline uint16_t medium_slab_free(uint8_t sizeclass)
{
return sizeclass_metadata.medium_slab_slots[sizeclass - NUM_SMALL_CLASSES];
return sizeclass_metadata.medium_slab_slots
[(sizeclass - NUM_SMALL_CLASSES)];
}
}