replace open-coded allocation size arithmetic with overflow-safe helpers#269
replace open-coded allocation size arithmetic with overflow-safe helpers#269rootvector2 wants to merge 3 commits intodovecot:mainfrom
Conversation
Replace several instances of multi-term allocation size arithmetic (e.g. sizeof(T) + variable, a + b + c) with small helper macros built on existing MALLOC_ADD and MALLOC_MULTIPLY. This keeps overflow handling centralized, improves consistency across the codebase, and makes size computations easier to audit. No behavioral changes intended.
src/lib/malloc-overflow.h
Outdated
| MALLOC_MULTIPLY(sizeof(type), (count)) | ||
|
|
||
| #define MALLOC_SIZEOF_PLUS(type, extra) \ | ||
| MALLOC_ADD(sizeof(type), (extra)) |
There was a problem hiding this comment.
To me these MALLOC_SIZEOF_* macros look like they're less readable, and also the resulting code isn't much smaller (1 byte if I count right).
src/lib-settings/settings-parser.c
Outdated
| st.st_size + 1); | ||
| size_t buf_size = MALLOC_ADD3(prefix_len, value_path_len, 1); | ||
| buf_size = MALLOC_ADD(buf_size, (size_t)st.st_size); | ||
| buf_size = MALLOC_ADD(buf_size, 1); |
There was a problem hiding this comment.
buf_size = MALLOC_ADD3(buf_size, (size_t)st.st_size, 1);
src/lib/stats-dist.c
Outdated
| i_malloc(sizeof(struct stats_dist) + | ||
| sizeof(uint64_t) * sample_count); | ||
| i_malloc(MALLOC_SIZEOF_PLUS(struct stats_dist, | ||
| MALLOC_SIZEOF_MULTIPLY(uint64_t, sample_count))); |
There was a problem hiding this comment.
I'm surprised there are so few allocations that are using arithmetic. But if we do these changes, we should change all of them to be consistent. You're missing some of the +1 ones, like dict-cdb.c, http-header.c, imap-parser.c, strfuncs.c at least. Also grep for t_malloc, that has some others too.
|
Thanks for the feedback. I’ve removed the MALLOC_SIZEOF_* helpers and kept only MALLOC_ADD3. Please let me know if this looks better. |
2 participants
Replace several instances of multi-term allocation size arithmetic (e.g. sizeof(T) + variable, a + b + c) with small helper macros built on existing MALLOC_ADD and MALLOC_MULTIPLY.
This keeps overflow handling centralized, improves consistency across the codebase, and makes size computations easier to audit.
No behavioral changes intended.