summaryrefslogtreecommitdiff
path: root/openbsd-compat/sys-queue.h
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2007-10-26 16:42:18 +1000
committerDamien Miller <djm@mindrot.org>2007-10-26 16:42:18 +1000
commit9aeef6b50d23a9f430b65c6f3454d14db0083832 (patch)
treeb7b6329c494dce38437f019db2a846787b3a0ea2 /openbsd-compat/sys-queue.h
parentd129ecb0f98ea6e7e83f2a0a8914d3f99d5184c9 (diff)
- otto@cvs.openbsd.org 2005/10/17 20:19:42
[openbsd-compat/sys-queue.h] Performing certain operations on queue.h data structurs produced funny results. An example is calling LIST_REMOVE on the same element twice. This will not fail, but result in a data structure referencing who knows what. Prevent these accidents by NULLing some fields on remove and replace. This way, either a panic or segfault will be produced on the faulty operation.
Diffstat (limited to 'openbsd-compat/sys-queue.h')
-rw-r--r--openbsd-compat/sys-queue.h15
1 files changed, 14 insertions, 1 deletions
diff --git a/openbsd-compat/sys-queue.h b/openbsd-compat/sys-queue.h
index 61e4ca7b..ee2ce30b 100644
--- a/openbsd-compat/sys-queue.h
+++ b/openbsd-compat/sys-queue.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: queue.h,v 1.27 2005/02/25 13:29:30 deraadt Exp $ */
+/* $OpenBSD: queue.h,v 1.28 2005/10/17 20:19:42 otto Exp $ */
/* $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $ */
/*
@@ -236,6 +236,7 @@ struct { \
curelm = curelm->field.sle_next; \
curelm->field.sle_next = \
curelm->field.sle_next->field.sle_next; \
+ (elm)->field.sle_next = NULL; \
} \
} while (0)
@@ -303,6 +304,8 @@ struct { \
(elm)->field.le_next->field.le_prev = \
(elm)->field.le_prev; \
*(elm)->field.le_prev = (elm)->field.le_next; \
+ (elm)->field.le_prev = NULL; \
+ (elm)->field.le_next = NULL; \
} while (0)
#define LIST_REPLACE(elm, elm2, field) do { \
@@ -311,6 +314,8 @@ struct { \
&(elm2)->field.le_next; \
(elm2)->field.le_prev = (elm)->field.le_prev; \
*(elm2)->field.le_prev = (elm2); \
+ (elm)->field.le_prev = NULL; \
+ (elm)->field.le_next = NULL; \
} while (0)
/*
@@ -465,6 +470,8 @@ struct { \
else \
(head)->tqh_last = (elm)->field.tqe_prev; \
*(elm)->field.tqe_prev = (elm)->field.tqe_next; \
+ (elm)->field.tqe_prev = NULL; \
+ (elm)->field.tqe_next = NULL; \
} while (0)
#define TAILQ_REPLACE(head, elm, elm2, field) do { \
@@ -475,6 +482,8 @@ struct { \
(head)->tqh_last = &(elm2)->field.tqe_next; \
(elm2)->field.tqe_prev = (elm)->field.tqe_prev; \
*(elm2)->field.tqe_prev = (elm2); \
+ (elm)->field.tqe_prev = NULL; \
+ (elm)->field.tqe_next = NULL; \
} while (0)
/*
@@ -575,6 +584,8 @@ struct { \
else \
(elm)->field.cqe_prev->field.cqe_next = \
(elm)->field.cqe_next; \
+ (elm)->field.cqe_next = NULL; \
+ (elm)->field.cqe_prev = NULL; \
} while (0)
#define CIRCLEQ_REPLACE(head, elm, elm2, field) do { \
@@ -588,6 +599,8 @@ struct { \
(head).cqh_first = (elm2); \
else \
(elm2)->field.cqe_prev->field.cqe_next = (elm2); \
+ (elm)->field.cqe_next = NULL; \
+ (elm)->field.cqe_prev = NULL; \
} while (0)
#endif /* !_FAKE_QUEUE_H_ */