Hello Eitan, ptr is not changed in realloc (although its allocated memory region is freed). Is it possible that hash_table_del only takes the value of ptr and removes such an entry from the hash table? While *ptr is not accessed, that should be fine, shouldn't it?
Regards. 2012/12/20 Eitan Adler <[email protected]> > Hey, > > in xrealloc_impl > > 338 new_ptr = realloc(ptr, new_size); > 339 if (new_ptr != NULL) > 340 { > 341 hash_table_del(xmalloc_table, ptr); > > ^^^ isn't this a use-after-free of ptr? > > ยง7.22.3.5.2 says that ptr is deallocated after the call to realloc. > > 342 hash_table_add(xmalloc_table, new_ptr, (int)new_size, file, > line, func); > 343 } > > > > -- > Eitan Adler > _______________________________________________ > [email protected] mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-hackers > To unsubscribe, send any mail to "[email protected]" -- Fry: You can see how I lived before I met you. Bender: You lived before you met me?! Fry: Yeah, lots of people did. Bender: Really?! _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "[email protected]"
