BigfootDev/flatbuffers
1
0
Fork 1
mirror of https://github.com/google/flatbuffers.git synced 2026-07-03 06:32:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Stop CreateUninitializedVector returning a pointer to invalid memory.

Browse Source 
CreateUninitializedVector was performing the following actions:
    1. call StartVector.
    2. call make_space, and set buf to point to the reserved space.
    3. call EndVector.

The problem is that a call to EndVector can ultimately call make_space, which
if the buffer is full, will cause a reallocation, invalidating the value stored
in buf.  So setting buf needs to be delayed until after EndVector.

The following code, when run under valgrind shows a write to free'd memory before
the change, but no such error after:

int main()
{
    flatbuffers::FlatBufferBuilder fbb(128);
    char *buf = nullptr;
    fbb.CreateUninitializedVector(128, &buf);
    *buf = 0;
}
This commit is contained in:
Nnamdi
2016-04-13 23:04:27 +01:00
parent 4a04bac250
commit 039ab48b7a
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
include/flatbuffers/flatbuffers.h
View File

@@ -1051,8 +1051,11 @@ FLATBUFFERS_FINAL_CLASS
uint8_t **buf) { uint8_t **buf) {
NotNested(); NotNested();
StartVector(len, elemsize); StartVector(len, elemsize);
*buf = buf_.make_space(len * elemsize); buf_.make_space(len * elemsize);
return EndVector(len); auto vec_start = GetSize();
auto vec_end = EndVector(len);
*buf = buf_.data_at(vec_start);
return vec_end;
} }
/// @brief Specialized version of `CreateVector` for non-copying use cases. /// @brief Specialized version of `CreateVector` for non-copying use cases.