devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

tlsf fix corruption checks

Browse source 
Turns out (~PTR_MASK) != (0xFFFFFFFF - PTR_MASK) in 64 bit land

tmp_b = (bhdr_t*) ( (intptr_t)b->prev_hdr & BLOCK_SIZE );

using ~STATE_MASK or even #define BLOCK_SIZE (~PTR_MASK) resolves the issue

switching  BLOCK_SIZE TO  ~STATE_MASK appears to fix it

Also define BLOCK_SIZE (~PTR_MASK)

Fix a few signed / unsigned errors

Change-Id: Ica59db0faa2df408831c23312243ae19259dba6b
This commit is contained in:
William Wilgus 2023-01-02 10:09:46 -05:00
parent 3def8fee8c
commit 6cbf2160e5
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/tlsf/src/tlsf.c
View file

@ -163,7 +163,7 @@ void abort(void);
#define TLSF_SIGNATURE (0x2A59FA59)
#define PTR_MASK (sizeof(void *) - 1)
#define BLOCK_SIZE (0xFFFFFFFF - PTR_MASK)
#define BLOCK_SIZE (~PTR_MASK) /* BUGFIX (0xFFFFFFFF - PTR_MASK) */
/* Dereferencing type-punned pointers will break strict aliasing.*/
@ -342,12 +342,12 @@ static __inline__ int ms_bit(int i)
static __inline__ void set_bit(int nr, u32_t * addr)
{
addr[nr >> 5] |= 1 << (nr & 0x1f);
addr[nr >> 5] |= 1u << (nr & 0x1f);
}
static __inline__ void clear_bit(int nr, u32_t * addr)
{
addr[nr >> 5] &= ~(1 << (nr & 0x1f));
addr[nr >> 5] &= ~(1u << (nr & 0x1f));
}
static __inline__ void MAPPING_SEARCH(size_t * _r, int *_fl, int *_sl)
@ -871,7 +871,7 @@ void free_ex(void *ptr, void *mem_pool)
}
if (b->size & PREV_FREE) {
/* Coalesce previous block */
tmp_b = (bhdr_t*) ( (intptr_t)b->prev_hdr & BLOCK_SIZE );
tmp_b = (bhdr_t*) ( (intptr_t)b->prev_hdr & ~STATE_MASK );
MAPPING_INSERT(tmp_b->size & BLOCK_SIZE, &fl, &sl);
EXTRACT_BLOCK(tmp_b, tlsf, fl, sl);
tmp_b->size += (b->size & BLOCK_SIZE) + BHDR_OVERHEAD;