Menu

#1 crash when using large integers in hashing function

open
nobody
None
5
2004-09-02
2004-09-02
No

When a large interger is cast to int it becomes negative and
results in a wild pointer being dereferenced

int trc_remove_thread(tid_t id)
{
int i, ret = 1;
tthread_t *cur, *next;

if\(id == 0\) 
    id = pthread\_self\(\);

HASH\_WRITE\_ENTER\(\); 
i = HASH\(\(int\)id\);

FIX:

i = HASH\(\(unsigned int\)id\);

Discussion


Log in to post a comment.

MongoDB Logo MongoDB