lib: Fixed crashes in timing_get_median() and timing_get_95th()

These were writing outside allocated memory. They weren't actually used
anywhere yet though.

diff --git a/src/lib/test-timing.c b/src/lib/test-timing.c
index 467e47d3948fd4eb41a1f386f48b1ee5fcd0eec3..c79d144dc39bcb919d1c589de1a10d6f3e8dc5ce 100644 (file)
--- a/src/lib/test-timing.c
+++ b/src/lib/test-timing.c
@@ -77,4 +77,19 @@ void test_timing(void)
                timing_deinit(&t);
                test_end();
        }
+
+       test_begin("timings large");
+       t = timing_init();
+       for (i = 0; i < 10000; i++)
+               timing_add_usecs(t, i);
+       test_assert(timing_get_count(t) == i);
+       test_assert(timing_get_sum(t) == (i-1)*i/2);
+       test_assert(timing_get_min(t) == 0);
+       test_assert(timing_get_max(t) == i-1);
+       test_assert(timing_get_avg(t) == i/2);
+       /* just test that these work: */
+       test_assert(timing_get_median(t) > 0 && timing_get_median(t) < i-1);
+       test_assert(timing_get_95th(t) > 0 && timing_get_95th(t) < i-1);
+       timing_deinit(&t);
+       test_end();
 }

diff --git a/src/lib/timing.c b/src/lib/timing.c
index 9b8e2354fa227001db61988de55ad760e96c7191..604f102a3f4f5f3638353d751d9a3986df5536a6 100644 (file)
--- a/src/lib/timing.c
+++ b/src/lib/timing.c
@@ -90,7 +90,11 @@ static void timing_ensure_sorted(struct timing *timing)
 {
        if (timing->sorted)
                return;
-       i_qsort(timing->samples, timing->count, sizeof(*timing->samples),
+
+       unsigned int count = (timing->count < TIMING_SUBSAMPLING_BUFFER)
+               ? timing->count
+               : TIMING_SUBSAMPLING_BUFFER;
+       i_qsort(timing->samples, count, sizeof(*timing->samples),
                uint64_cmp);
        timing->sorted = TRUE;
 }