authorgravatar for erik.arvstedt@gmail.comErik Arvstedt <erik.arvstedt@gmail.com> 2023-06-12 22:21:29+02:00
committergravatar for erik.arvstedt@gmail.comErik Arvstedt <erik.arvstedt@gmail.com> 2023-06-13 09:46:16+02:00
log41430a366f75eb7301deaca91d4aea3bbf61c8ec
treebf2c9415996623fa9b9d41329ce0dcb3631d3b22
parentc16d4ab9e41be6b5c560d15eaa145ff3a0ffce6c

arena_allocator/reset: fix buffer overrun

Previously, the buffer reserved with `retain_with_limit` was missing space for the `BufNode`. When the user-provided a limit that was smaller than `@sizeOf(BufNode)`, `reset` would store a new `BufNode` in an allocation smaller than `BufNode`, leading to a buffer overrun.

1 files changed, 1 insertions(+), 1 deletions(-)

lib/std/heap/arena_allocator.zig+1-1
......@@ -120,7 +120,7 @@ pub const ArenaAllocator = struct {
120120 }
121121 const total_size = switch (mode) {
122122 .retain_capacity => current_capacity,
123 .retain_with_limit => |limit| std.math.min(limit, current_capacity),
123 .retain_with_limit => |limit| std.math.min(@sizeOf(BufNode) + limit, current_capacity),
124124 .free_all => unreachable,
125125 };
126126 const align_bits = std.math.log2_int(usize, @alignOf(BufNode));