Skip to content

Commit c908666

Browse files
committed
CFSTORE - fix handling of realloc fail on delete
The function cfstore_delete_ex is written under the assumption that CFSTORE_REALLOC will never fail if the size is decreasing. Regardless of the status of CFSTORE_REALLOC the entry is removed from the config store and zeroed. This works correctly if CFSTORE_REALLOC correctly updates area_0_tail, but can lead to crashes in the case area_0_tail is left unchanged. The crash is because when iterating over the config store data, cfstore_get_next_hkvt is unable to determine the end of valid data. This patch fixes this problem by handling the realloc failure case by updating area_0_tail even if CFSTORE_REALLOC returns NULL. This patch also adds an assert to check for out of bound entries in when calling cfstore_get_next_hkvt. This allows an assert to be triggered if this bug is re-introduced, rather than a crash.
1 parent de8ce0e commit c908666

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

features/storage/FEATURE_STORAGE/cfstore/source/configuration_store.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1294,6 +1294,7 @@ static int32_t cfstore_get_next_hkvt(cfstore_area_hkvt_t* prev, cfstore_area_hkv
12941294

12951295
CFSTORE_ASSERT(prev != NULL);
12961296
CFSTORE_ASSERT(next != NULL);
1297+
CFSTORE_ASSERT(prev->tail <= ctx->area_0_tail);
12971298

12981299
if(prev->tail == ctx->area_0_tail){
12991300
CFSTORE_TP(CFSTORE_TP_VERBOSE1, "%s:reached the end of the list. return NULL entry\n", __func__);
@@ -1433,6 +1434,14 @@ static int32_t cfstore_realloc_ex(ARM_CFSTORE_SIZE size, uint64_t *allocated_siz
14331434
}
14341435

14351436
ptr = (uint8_t*) CFSTORE_REALLOC((void*) ctx->area_0_head, size);
1437+
if (ptr == NULL) {
1438+
if (total_kv_size <= ctx->area_0_len) {
1439+
/* Size is shrinking so a realloc failure is recoverable.
1440+
* Update ptr so it matches the previous head.
1441+
*/
1442+
ptr = ctx->area_0_head;
1443+
}
1444+
}
14361445
if(ptr == NULL){
14371446
CFSTORE_ERRLOG("%s:Error: unable to allocate memory (size=%d)\n", __func__, (int) size);
14381447
/* realloc() has failed to allocate the required memory object. If previously

0 commit comments

Comments
 (0)