[Verse-dev] Small bug in the server regarding fragments

Mattias Claesson slas+versedev at pdc.kth.se
Thu Nov 9 10:48:41 CET 2006


Hi,

Yesterday I found a small bug in the server when creating fragments with IDs
16-32 numbers bigger than current highest fragment ID. Here is the responsible
code:

vs_node_material.c:

66:        if(node->frag_count + 32 < frag_id)
67:                frag_id = (uint16)-1;
68:        if(frag_id == (uint16) ~0u)
69:                for(frag_id = 0; frag_id < node->frag_count && node->frag[frag_id].type < VN_M_FT_OUTPUT + 1; frag_id++)
70:                        ;
71:        if(frag_id >= node->frag_count)
72:        {
73:                node->frag = realloc(node->frag, (sizeof *node->frag) * (node->frag_count + 16));
74:                for(i = node->frag_count; i < (node->frag_count + 16); i++)
75:                        node->frag[i].type = 255;
76:                node->frag_count += 16;
77:        }
78:        node->frag[frag_id].type = type;
79:        node->frag[frag_id].frag = *fragment;

Lines 66-67 will fall back to server generated IDs if the requested ID is more
than 32 above the current high, but lines 71-77 will only extend the fragment
array by 16 entries. Increasing by 32 instead obviously increases the amount of
wasted memory, but lowering to 16 breaks my current code. So now you know which
solution I prefer :-) I haven't checked if there are any more similar
mismatches elsewhere in the code.

Mattias


More information about the Verse-dev mailing list