Skip to content

Commit b517ae3

Browse files
fmayerjvoisin
authored andcommitted
Fix UB in pops.c
It is undefined behaviour to construct a pointer that is out-of-bounds, not just to use it.
1 parent 3553558 commit b517ae3

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

bench/cfrac/pops.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -91,10 +91,11 @@ precision palloc(size)
9191
register posit size;
9292
{
9393
register precision w;
94-
register cacheType *kludge = pcache + size; /* for shitty compilers */
94+
register cacheType *kludge; /* for shitty compilers */
9595

9696
#if !(defined(NOMEMOPT) || defined(BWGC))
97-
if (size < CACHESIZE && (w = kludge->next) != pUndef) {
97+
if (size < CACHESIZE && (kludge = pcache + size) &&
98+
(w = kludge->next) != pUndef) {
9899
kludge->next = ((cacheType *) w)->next;
99100
--kludge->count;
100101
} else {
@@ -135,9 +136,9 @@ int pfree(u)
135136

136137
size = u->alloc;
137138

138-
kludge = pcache + size;
139139
#if !(defined(NOMEMOPT) || defined(BWGC))
140-
if (size < CACHESIZE && kludge->count < CACHELIMIT) {
140+
if (size < CACHESIZE && (kludge = pcache + size) &&
141+
kludge->count < CACHELIMIT) {
141142
((cacheType *) u)->next = kludge->next;
142143
kludge->next = u;
143144
kludge->count++;

0 commit comments

Comments
 (0)