[exim-dev] [Bug 1708] Segfault on lsearch lookup

Top Page
Delete this message
Reply to this message
Author: admin
Date:  
To: exim-dev
Subject: [exim-dev] [Bug 1708] Segfault on lsearch lookup
https://bugs.exim.org/show_bug.cgi?id=1708

Git Commit <git@???> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |git@???


--- Comment #10 from Git Commit <git@???> ---
Git commit:
http://git.exim.org/exim.git/commitdiff/98b98887f926be87eabccc7919e57ce625c63c03

commit 98b98887f926be87eabccc7919e57ce625c63c03
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Mon Nov 2 19:03:26 2015 +0000
Commit:     Jeremy Harris <jgh146exb@???>
CommitDate: Mon Nov 2 19:03:26 2015 +0000


    Avoid misaligned access in cached lookup.  Bug 1708
---
 doc/doc-txt/ChangeLog | 4 +++-
 src/src/search.c      | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)


diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 8780780..cea29ee 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -63,9 +63,11 @@ JH/10 Bug 840: fix log_defer_output option of pipe transport
 JH/11 Bug 830: use same host for all RCPTS of a message, even under
       hosts_randomize.  This matters a lot when combined with mua_wrapper.


-JH/12 Bug 1706: percent and underbar characters are no longer excaped by the
+JH/12 Bug 1706: percent and underbar characters are no longer escaped by the
       ${quote_pgsql:<string>} operator.


+JH/13 Bug 1708: avoid misaligned access in cached lookup.
+

 Exim version 4.86
 -----------------
diff --git a/src/src/search.c b/src/src/search.c
index cd522da..ccad250 100644
--- a/src/src/search.c
+++ b/src/src/search.c
@@ -540,10 +540,10 @@ else
       }
     else
       {
-      t = store_get(sizeof(tree_node) + len + sizeof(expiring_data));
-      e = (expiring_data *)((char *)t + sizeof(tree_node) + len);
+      e = store_get(sizeof(expiring_data) + sizeof(tree_node) + len);
       e->expiry = do_cache == UINT_MAX ? 0 : time(NULL)+do_cache;
       e->ptr = data;
+      t = (tree_node *)(e+1);
       memcpy(t->name, keystring, len);
       t->data.ptr = e;
       tree_insertnode(&c->item_cache, t);


--
You are receiving this mail because:
You are on the CC list for the bug.