ARMmbed
/
mbed-os
mirror of https://github.com/ARMmbed/mbed-os.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

CFSTORE - fix handling of realloc fail on delete 

The function cfstore_delete_ex is written under the assumption that
CFSTORE_REALLOC will never fail if the size is decreasing. Regardless
of the status of CFSTORE_REALLOC the entry is removed from the config
store and zeroed. This works correctly if CFSTORE_REALLOC correctly
updates area_0_tail, but can lead to crashes in the case area_0_tail is
left unchanged. The crash is because when iterating over the config
store data, cfstore_get_next_hkvt is unable to determine the end of
valid data.

This patch fixes this problem by handling the realloc failure case by
updating area_0_tail even if CFSTORE_REALLOC returns NULL. This
patch also adds an assert to check for out of bound entries in when
calling cfstore_get_next_hkvt. This allows an assert to be triggered
if this bug is re-introduced, rather than a crash.
pull/3035/head
Russ Butler 2016-10-16 18:39:31 -05:00
parent de8ce0e43e
commit c908666d63
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
features/storage/FEATURE_STORAGE/cfstore/source/configuration_store.c
View File

@ -1294,6 +1294,7 @@ static int32_t cfstore_get_next_hkvt(cfstore_area_hkvt_t* prev, cfstore_area_hkv
CFSTORE_ASSERT(prev != NULL);
CFSTORE_ASSERT(next != NULL);
CFSTORE_ASSERT(prev->tail <= ctx->area_0_tail);
if(prev->tail == ctx->area_0_tail){
CFSTORE_TP(CFSTORE_TP_VERBOSE1, "%s:reached the end of the list. return NULL entry\n", __func__);
@ -1433,6 +1434,14 @@ static int32_t cfstore_realloc_ex(ARM_CFSTORE_SIZE size, uint64_t *allocated_siz
}
ptr = (uint8_t*) CFSTORE_REALLOC((void*) ctx->area_0_head, size);
if (ptr == NULL) {
if (total_kv_size <= ctx->area_0_len) {
/* Size is shrinking so a realloc failure is recoverable.
* Update ptr so it matches the previous head.
*/
ptr = ctx->area_0_head;
}
}
if(ptr == NULL){
CFSTORE_ERRLOG("%s:Error: unable to allocate memory (size=%d)\n", __func__, (int) size);
/* realloc() has failed to allocate the required memory object. If previously