mirror of https://github.com/ARMmbed/mbed-os.git
d9ad7bbb99
- issue 17: Heap corruption.
- issue 23: Handles invalidated when realloc called.
- issue 24: cfstore_find returns error when "previous" parameter is NULL.
- issue 25: Memory leak when out of memory.
With respect to issues 17 and 23:
- A code defect existed for correctly updating cfstore_file_t data structures
under the following conditions:
-- the KV memory area contained some KV's.
-- cfstore calls realloc() to increase the size of the KV area in
memory because:
* A new KV was being added to the KV area, or
* the size of a pre-existing KV was being increased.
-- The returned address from realloc() has changed from before the
call (i.e. the location in memory of the KV area has changed)
e.g. the presence of heap memory objects directly above the KV memory
area in the memory address space causes realloc() to move the KV area
so the newly increased area can be accommodated at contiguous addresses.
-- In this scenario, the cfstore_file_t (structures for open files) head pointers
do not get correctly updated.
-- The defect was fixed by correctly updating the cfstore_file_t:: head pointer.
-- A new add_del test case was added to the scenario where a new KV is being added
to the KV area.
-- A new create test case was added to the scenario where the size of a
pre-existing KV is being increased in size.
- A code defect for suppling a NULL handle as the previous argument to the Find() method
(issue 24).
-- Supply a null handle is valid, but it was being used to check for a valid hkey,
which was incorrect.
-- A new test case was added to check the case of supplying a NULL previous argument
works correctly.
- A code defect for a memory leak under the following conditions (issue 25):
-- When realloc() fails to perform a requested change to the size of the KV area, the
error handling sometimes incorrectly sets cfstore_context_t::area_0_head to NULL.
Cfstore returns a suitable error to the client. If memory had previously been held
at area_0_head, realloc(area_0_head, size) returning NULL means the memory
at area_0_head is still retained.
-- On receiving the error code, the client cleans up including a call to Uninitialize().
This should free the retained but as area_0_head == NULL this is not possible. Hence
a memory leak occurred.
-- This was fixed by not setting area_0_head = NULL on the realloc() failure.
-- A create test case was modified to detect the leaking of memory in this way.
|
||
|---|---|---|
| .. | ||
| close.cpp | ||