niklas/cyclonedds
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix undefined behavior when hash function given null pointer

Browse source 
[test_subscriber-12] /opt/ros/master/src/eclipse-cyclonedds/cyclonedds/src/ddsrt/src/mh3.c:28:53: runtime error: applying zero offset to null pointer
[test_subscriber-12] SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /opt/ros/master/src/eclipse-cyclonedds/cyclonedds/src/ddsrt/src/mh3.c:28:53 in
Signed-off-by: Dan Rose <dan@digilabs.io>
This commit is contained in:
Dan Rose 2020-02-28 15:19:21 -06:00 • committed by Erik Boasson
parent e8b0931798
commit ca4b5a368f
2 changed files with 30 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

55
src/ddsrt/src/mh3.c
View file

@ -25,38 +25,41 @@ uint32_t ddsrt_mh3 (const void *key, size_t len, uint32_t seed)
const uint32_t c2 = 0x1b873593;
uint32_t h1 = seed;
const uint32_t *blocks = (const uint32_t *) (data + nblocks * 4);
for (intptr_t i = -nblocks; i; i++)
{
uint32_t k1 = blocks[i];
k1 *= c1;
k1 = DDSRT_MH3_ROTL32 (k1, 15);
k1 *= c2;
if(len){
const uint32_t *blocks = (const uint32_t *) (data + nblocks * 4);
for (intptr_t i = -nblocks; i; i++)
{
uint32_t k1 = blocks[i];
h1 ^= k1;
h1 = DDSRT_MH3_ROTL32 (h1, 13);
h1 = h1 * 5 + 0xe6546b64;
}
const uint8_t *tail = data + nblocks * 4;
uint32_t k1 = 0;
switch (len & 3)
{
case 3:
k1 ^= (uint32_t) tail[2] << 16;
/* FALLS THROUGH */
case 2:
k1 ^= (uint32_t) tail[1] << 8;
/* FALLS THROUGH */
case 1:
k1 ^= (uint32_t) tail[0];
k1 *= c1;
k1 = DDSRT_MH3_ROTL32 (k1, 15);
k1 *= c2;
h1 ^= k1;
/* FALLS THROUGH */
};
h1 = DDSRT_MH3_ROTL32 (h1, 13);
h1 = h1 * 5 + 0xe6546b64;
}
const uint8_t *tail = data + nblocks * 4;
uint32_t k1 = 0;
switch (len & 3)
{
case 3:
k1 ^= (uint32_t) tail[2] << 16;
/* FALLS THROUGH */
case 2:
k1 ^= (uint32_t) tail[1] << 8;
/* FALLS THROUGH */
case 1:
k1 ^= (uint32_t) tail[0];
k1 *= c1;
k1 = DDSRT_MH3_ROTL32 (k1, 15);
k1 *= c2;
h1 ^= k1;
/* FALLS THROUGH */
}
}
/* finalization */
h1 ^= (uint32_t) len;