|
1 |
| -/* $OpenBSD: bio_chain.c,v 1.7 2022/12/08 18:34:00 tb Exp $ */ |
| 1 | +/* $OpenBSD: bio_chain.c,v 1.8 2022/12/09 07:46:54 tb Exp $ */ |
2 | 2 | /*
|
3 | 3 | * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
|
4 | 4 | *
|
@@ -243,8 +243,9 @@ walk_backward(BIO *start, BIO *end, size_t expected_len, size_t i, size_t j,
|
243 | 243 | if (start == NULL || end == NULL)
|
244 | 244 | goto done;
|
245 | 245 |
|
246 |
| - len = 0; |
247 | 246 | prev = end;
|
| 247 | + len = 0; |
| 248 | + |
248 | 249 | do {
|
249 | 250 | next = prev;
|
250 | 251 | prev = BIO_prev(prev);
|
@@ -277,6 +278,7 @@ check_chain(BIO *start, BIO *end, size_t expected_len, size_t i, size_t j,
|
277 | 278 | {
|
278 | 279 | if (!walk_forward(start, end, expected_len, i, j, fn, description))
|
279 | 280 | return 0;
|
| 281 | + |
280 | 282 | if (!walk_backward(start, end, expected_len, i, j, fn, description))
|
281 | 283 | return 0;
|
282 | 284 |
|
@@ -318,9 +320,9 @@ check_chain(BIO *start, BIO *end, size_t expected_len, size_t i, size_t j,
|
318 | 320 | * After creating a new link, the new chain has length i + 1 + nitems(B) - j,
|
319 | 321 | * oldtail has length nitems(A) - i - 1 and oldhead has length j.
|
320 | 322 | *
|
321 |
| - * Prior to bio_lib.c r1.40, BIO_set_next(A[i], B[j]) results in both A[i] and |
322 |
| - * B[j - 1] pointing at B[j] while B[j] points back at A[i]. The result is |
323 |
| - * again double frees. |
| 323 | + * Prior to bio_lib.c r1.40, BIO_set_next(A[i], B[j]) would result in both A[i] |
| 324 | + * and B[j - 1] pointing at B[j] while B[j] would point back at A[i]. Calling |
| 325 | + * BIO_free_all(A[0]) and BIO_free_all(B[0]) results in a double free of B[j]. |
324 | 326 | *
|
325 | 327 | * XXX: Should check that the callback is called on BIO_push() as expected.
|
326 | 328 | */
|
@@ -354,9 +356,9 @@ link_chains_at(size_t i, size_t j, int use_bio_push)
|
354 | 356 | new_start = A[0];
|
355 | 357 | new_end = B[nitems(B) - 1];
|
356 | 358 |
|
357 |
| - oldhead_len = j; |
358 | 359 | oldhead_start = B[0];
|
359 | 360 | oldhead_end = BIO_prev(B[j]);
|
| 361 | + oldhead_len = j; |
360 | 362 |
|
361 | 363 | /* If we push B[0] or set next to B[0], the oldhead chain is empty. */
|
362 | 364 | if (j == 0) {
|
|
0 commit comments