Merged revisions 228858 via svnmerge from

https://origsvn.digium.com/svn/asterisk/trunk

................
  r228858 | mnicholson | 2009-11-09 08:37:07 -0600 (Mon, 09 Nov 2009) | 15 lines

  Merged revisions 228827 via svnmerge from
  https://origsvn.digium.com/svn/asterisk/branches/1.4

  ........
    r228827 | mnicholson | 2009-11-09 08:16:03 -0600 (Mon, 09 Nov 2009) | 8 lines

    Perform limited bounds checking when destroying ast_mutex_t structures to make sure we don't try to use negative indices.

    (closes issue #15588)
    Reported by: zerohalo
    Patches:
          20090820__issue15588.diff.txt uploaded by tilghman (license 14)
    Tested by: zerohalo
  ........
................

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.0@228861 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/include/asterisk/lock.h b/include/asterisk/lock.h
index b37156a10cb4409d46b844ee3f65efe4340f323e..123ae76d29b69279333b9f02151e8e66f137b745 100644 (file)
--- a/include/asterisk/lock.h
+++ b/include/asterisk/lock.h
@@ -312,6 +312,7 @@ static inline int __ast_pthread_mutex_init(int track, const char *filename, int
 #define ast_mutex_init_notracking(pmutex) \
        __ast_pthread_mutex_init(0, __FILE__, __LINE__, __PRETTY_FUNCTION__, #pmutex, pmutex)
 
+#define        ROFFSET ((t->reentrancy > 0) ? (t->reentrancy-1) : 0)
 static inline int __ast_pthread_mutex_destroy(const char *filename, int lineno, const char *func,
                                                const char *mutex_name, ast_mutex_t *t)
 {
@@ -346,7 +347,7 @@ static inline int __ast_pthread_mutex_destroy(const char *filename, int lineno,
                                   filename, lineno, func, mutex_name);
                ast_reentrancy_lock(t);
                __ast_mutex_logger("%s line %d (%s): Error: '%s' was locked here.\n",
-                           t->file[t->reentrancy-1], t->lineno[t->reentrancy-1], t->func[t->reentrancy-1], mutex_name);
+                           t->file[ROFFSET], t->lineno[ROFFSET], t->func[ROFFSET], mutex_name);
                ast_reentrancy_unlock(t);
                break;
        }
@@ -413,8 +414,8 @@ static inline int __ast_pthread_mutex_lock(const char *filename, int lineno, con
                                                           filename, lineno, func, (int) wait_time, mutex_name);
                                        ast_reentrancy_lock(t);
                                        __ast_mutex_logger("%s line %d (%s): '%s' was locked here.\n",
-                                                          t->file[t->reentrancy-1], t->lineno[t->reentrancy-1],
-                                                          t->func[t->reentrancy-1], mutex_name);
+                                                          t->file[ROFFSET], t->lineno[ROFFSET],
+                                                          t->func[ROFFSET], mutex_name);
                                        ast_reentrancy_unlock(t);
                                        reported_wait = wait_time;
                                }
@@ -524,11 +525,11 @@ static inline int __ast_pthread_mutex_unlock(const char *filename, int lineno, c
 #endif /* AST_MUTEX_INIT_W_CONSTRUCTORS */
 
        ast_reentrancy_lock(t);
-       if (t->reentrancy && (t->thread[t->reentrancy-1] != pthread_self())) {
+       if (t->reentrancy && (t->thread[ROFFSET] != pthread_self())) {
                __ast_mutex_logger("%s line %d (%s): attempted unlock mutex '%s' without owning it!\n",
                                   filename, lineno, func, mutex_name);
                __ast_mutex_logger("%s line %d (%s): '%s' was locked here.\n",
-                                  t->file[t->reentrancy-1], t->lineno[t->reentrancy-1], t->func[t->reentrancy-1], mutex_name);
+                                  t->file[ROFFSET], t->lineno[ROFFSET], t->func[ROFFSET], mutex_name);
                DO_THREAD_CRASH;
        }
 
@@ -603,11 +604,11 @@ static inline int __ast_cond_wait(const char *filename, int lineno, const char *
 #endif /* AST_MUTEX_INIT_W_CONSTRUCTORS */
 
        ast_reentrancy_lock(t);
-       if (t->reentrancy && (t->thread[t->reentrancy-1] != pthread_self())) {
+       if (t->reentrancy && (t->thread[ROFFSET] != pthread_self())) {
                __ast_mutex_logger("%s line %d (%s): attempted unlock mutex '%s' without owning it!\n",
                                   filename, lineno, func, mutex_name);
                __ast_mutex_logger("%s line %d (%s): '%s' was locked here.\n",
-                                  t->file[t->reentrancy-1], t->lineno[t->reentrancy-1], t->func[t->reentrancy-1], mutex_name);
+                                  t->file[ROFFSET], t->lineno[ROFFSET], t->func[ROFFSET], mutex_name);
                DO_THREAD_CRASH;
        }
 
@@ -674,11 +675,11 @@ static inline int __ast_cond_timedwait(const char *filename, int lineno, const c
 #endif /* AST_MUTEX_INIT_W_CONSTRUCTORS */
 
        ast_reentrancy_lock(t);
-       if (t->reentrancy && (t->thread[t->reentrancy-1] != pthread_self())) {
+       if (t->reentrancy && (t->thread[ROFFSET] != pthread_self())) {
                __ast_mutex_logger("%s line %d (%s): attempted unlock mutex '%s' without owning it!\n",
                                   filename, lineno, func, mutex_name);
                __ast_mutex_logger("%s line %d (%s): '%s' was locked here.\n",
-                                  t->file[t->reentrancy-1], t->lineno[t->reentrancy-1], t->func[t->reentrancy-1], mutex_name);
+                                  t->file[ROFFSET], t->lineno[ROFFSET], t->func[ROFFSET], mutex_name);
                DO_THREAD_CRASH;
        }