Fix error found by Madhu Kurup:

  Loop overrun occurs as the i+1 value is being processed. A code path
  exists where i can be uninitialized but incremented (line 1082).

git-svn-id: svn://svn.valgrind.org/valgrind/trunk@3800

diff --git a/massif/ms_main.c b/massif/ms_main.c
index ce5deeef9c6b819eb2aada98442787946d6b26ea..f695b66074a46853737a3e01131514813157768c 100644 (file)
--- a/massif/ms_main.c
+++ b/massif/ms_main.c
@@ -923,7 +923,7 @@ static void halve_censi(void)
 
    // Sets j to the index of the first not-yet-removed census at or after i
    #define FIND_CENSUS(i, j) \
-      for (j = i; -1 == censi[j].ms_time; j++) { }
+      for (j = i; j < MAX_N_CENSI && -1 == censi[j].ms_time; j++) { }
 
    for (i = 2; i < MAX_N_CENSI; i += 2) {
       // Find the censi representing the smallest timespan.  The timespan
@@ -989,7 +989,6 @@ static void hp_census(void)
    static UInt ms_next_census = 0;     // zero allows startup census
 
    Int     ms_time, ms_time_since_prev;
-   Int     i, K;
    Census* census;
 
    VGP_PUSHCC(VgpCensus);
@@ -1010,6 +1009,7 @@ static void hp_census(void)
 
    // Heap: snapshot the K most significant XTrees -------------------
    if (clo_heap) {
+      Int i, K;
       K = ( alloc_xpt->n_children < MAX_SNAPSHOTS 
           ? alloc_xpt->n_children
           : MAX_SNAPSHOTS);     // max out
@@ -1086,7 +1086,6 @@ static void hp_census(void)
       census->stacks_space = sigstacks_space;
       // slightly abusing this function
       VG_(first_matching_thread_stack)( count_stack_size, &census->stacks_space );
-      i++;
    }
 
    // Finish, update interval if necessary -----------------------------