d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix an off-by-two in the llquantize() action parameter validation.

Browse Source 
The aggregation created by llquantize() partitions values into buckets; the
lower bound of the bucket containing the largest values is b^{m+1}, where
b and m are the second and fourth parameters to the action, respectively.
Bucket bounds are stored in a 64-bit integer, and so the llquantize()
validation checks need to verify that b^{m+1} fits in 64 bits. However, it
was only verifying that b^{m-1} fits in 64 bits, so certain parameter
combinations could trigger assertion failures in libdtrace.

PR:		219451
MFC after:	1 week
This commit is contained in:
Mark Johnston 2017-08-21 21:56:02 +00:00
parent 3c0e63a4c4
commit ce4da6fccc
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=322773
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cddl/contrib/opensolaris/lib/libdtrace/common/dt_cc.c
View File

@ -1503,7 +1503,7 @@ dt_compile_agg(dtrace_hdl_t *dtp, dt_node_t *dnp, dtrace_stmtdesc_t *sdp)
"divide a power of the factor\n"); "divide a power of the factor\n");
} }
for (i = 0, order = 1; i < args[2].value; i++) { for (i = 0, order = 1; i <= args[2].value + 1; i++) {
if (order * args[0].value > order) { if (order * args[0].value > order) {
order *= args[0].value; order *= args[0].value;
continue; continue;
@ -1511,7 +1511,7 @@ dt_compile_agg(dtrace_hdl_t *dtp, dt_node_t *dnp, dtrace_stmtdesc_t *sdp)
dnerror(dnp, D_LLQUANT_MAGTOOBIG, "llquantize( ) " dnerror(dnp, D_LLQUANT_MAGTOOBIG, "llquantize( ) "
"factor (%d) raised to power of high magnitude " "factor (%d) raised to power of high magnitude "
"(%d) overflows 64-bits\n", args[0].value, "(%d) plus 1 overflows 64-bits\n", args[0].value,
args[2].value); args[2].value);
} }