Mercurial > hg > openjdk > icedtea > jdk7 > hotspot

changeset 596:83ef1482304c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
6806226: Signed integer overflow in growable array code causes JVM crash Summary: Workaround the overflow by doing the intermediate calculations in an unsigned variable. Reviewed-by: ysr, jcoomes
author jmasa
date Tue, 24 Feb 2009 22:12:24 -0800
parents a0576ae7045f
children 59150d6667e1
files src/share/vm/utilities/growableArray.cpp
diffstat 1 files changed, 5 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/vm/utilities/growableArray.cpp	Fri Feb 20 11:12:26 2009 -0800
+++ b/src/share/vm/utilities/growableArray.cpp	Tue Feb 24 22:12:24 2009 -0800
@@ -43,11 +43,13 @@
 #endif
 
 void* GenericGrowableArray::raw_allocate(int elementSize) {
+  assert(_max >= 0, "integer overflow");
+  size_t byte_size = elementSize * (size_t) _max;
   if (on_stack()) {
-    return (void*)resource_allocate_bytes(elementSize * _max);
+    return (void*)resource_allocate_bytes(byte_size);
   } else if (on_C_heap()) {
-    return (void*)AllocateHeap(elementSize * _max, "GrET in " __FILE__);
+    return (void*)AllocateHeap(byte_size, "GrET in " __FILE__);
   } else {
-    return _arena->Amalloc(elementSize * _max);
+    return _arena->Amalloc(byte_size);
   }
 }