diff options
| author | David Lamparter <equinox@opensourcerouting.org> | 2023-04-21 16:23:39 +0200 |
|---|---|---|
| committer | David Lamparter <equinox@opensourcerouting.org> | 2023-04-21 16:30:32 +0200 |
| commit | 5523a505f4bd6ce57f951ccb0cc7b9b29a963d7c (patch) | |
| tree | d72b5165b99b42f6d2831d11351ad88f0cd2a118 /lib/typesafe.h | |
| parent | ae19023b8e00c6a8d4ae9d631d8db15fb4924800 (diff) | |
lib: fix _hash_member() crash w/ empty hash
The typesafe hash _member() didn't check tabshift/count before
proceeding to look at the hash table, leading it to dereference a NULL
pointer when the hash table is in fact empty.
Test case added to tests/lib/test_typelist.
Note this function is not currently used anywhere. Only lib/cspf.c uses
_member(), but it does so on a RB-tree rather than a hash.
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Diffstat (limited to 'lib/typesafe.h')
| -rw-r--r-- | lib/typesafe.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/typesafe.h b/lib/typesafe.h index 66612be167..8eb59c33b7 100644 --- a/lib/typesafe.h +++ b/lib/typesafe.h @@ -948,6 +948,8 @@ macro_pure size_t prefix ## _count(const struct prefix##_head *h) \ macro_pure bool prefix ## _member(const struct prefix##_head *h, \ const type *item) \ { \ + if (!h->hh.tabshift) \ + return NULL; \ uint32_t hval = item->field.hi.hashval, hbits = HASH_KEY(h->hh, hval); \ const struct thash_item *hitem = h->hh.entries[hbits]; \ while (hitem && hitem->hashval < hval) \ |