From: Michael Haggerty <mhagger@alum.mit.edu>
To: Junio C Hamano <gitster@pobox.com>
Cc: Jeff King <peff@peff.net>, Thomas Rast <tr@thomasrast.ch>,
"brian m. carlson" <sandals@crustytoothpaste.net>,
git@vger.kernel.org, Jens Lehmann <Jens.Lehmann@web.de>,
John Keeping <john@keeping.me.uk>,
Guillaume Gelin <contact@ramnes.eu>
Subject: Re: [PATCH] mv: prevent mismatched data when ignoring errors.
Date: Mon, 17 Mar 2014 16:07:46 +0100 [thread overview]
Message-ID: <53270FC2.2030701@alum.mit.edu> (raw)
In-Reply-To: <7vtxax2v1q.fsf@alter.siamese.dyndns.org>
On 03/17/2014 07:33 AM, Junio C Hamano wrote:
> Junio C Hamano <gitster@pobox.com> writes:
>
>> Would it make sense to go one step further to introduce two macros
>> to make this kind of screw-up less likely?
>> ...
>> After letting my eyes coast over hits from "git grep memmove", there
>> do seem to be some places that these would help readability, but not
>> very many.
>
> I see quite a many hits that follow this pattern
>
> memmove(array + pos, array + pos + 1, sizeof(*array) * (nr - pos))
>
> to make a single slot in a middle of array available, which would be
> good candidates to use MOVE_DOWN(). Just to show a few:
>
> builtin/mv.c:226: memmove(source + i, source + i + 1,
> builtin/mv.c-227- (argc - i) * sizeof(char *));
> builtin/mv.c:228: memmove(destination + i,
> builtin/mv.c-229- destination + i + 1,
> builtin/mv.c-230- (argc - i) * sizeof(char *));
> cache-tree.c:92: memmove(it->down + pos + 1,
> cache-tree.c-93- it->down + pos,
> cache-tree.c-94- sizeof(down) * (it->subtree_nr - pos - 1));
>
>
> Perhaps something like this patch to start off; I am not sure
> MOVE_DOWN_BOUNDED is needed, though.
>
> cache.h | 33 +++++++++++++++++++++++++++++++++
> 1 file changed, 33 insertions(+)
>
> diff --git a/cache.h b/cache.h
> index b66cb49..b2615ab 100644
> --- a/cache.h
> +++ b/cache.h
> @@ -455,6 +455,39 @@ extern int daemonize(void);
> } \
> } while (0)
>
> +/*
> + * With an array "array" that currently holds "nr" elements, move
> + * elements at "at" and later down by "count" elements to make room to
> + * add in new elements. The caller is responsible for making sure
> + * that the array has enough room to hold "nr" + "count" slots.
> + */
> +#define MOVE_DOWN(array, nr, at, count) \
> + memmove((array) + (at) + (count), \
> + (array) + (at), \
> + sizeof((array)[0]) * ((nr) - (at)))
> +
> +/*
> + * With an array "array" that has enough memory to hold "alloc"
> + * elements allocated and currently holds "nr" elements, move elements
> + * at "at" and later down by "count" elements to make room to add in
> + * new elements.
> + */
> +#define MOVE_DOWN_BOUNDED(array, nr, at, count, alloc) \
> + do { \
> + if ((alloc) <= (nr) + (count)) \
> + BUG("MOVE_DOWN beyond the end of an array"); \
> + MOVE_DOWN((array), (nr), (at), (count)); \
> + } while (0)
> +
> +/*
> + * With an array "array" that curently holds "nr" elements, move elements
> + * at "at" + "count" and later down by "count" elements, removing the
> + * elements between "at" and "at" + "count".
> + */
> +#define MOVE_UP(array, nr, at, count) \
> + memmove((array) + (at), (array) + (at) + (count), \
> + sizeof((array)[0]) * ((nr) - ((at) + (count))))
> +
> /* Initialize and use the cache information */
> extern int read_index(struct index_state *);
> extern int read_index_preload(struct index_state *, const struct pathspec *pathspec);
I had recently been thinking along the same lines. In many of the
potential callers that I noticed, ALLOC_GROW() was used immediately
before making space in the array for a new element. So I suggest
something more like
+#define MOVE_DOWN(array, nr, at, count) \
+ memmove((array) + (at) + (count), \
+ (array) + (at), \
+ sizeof((array)[0]) * ((nr) - (at)))
+#define ALLOC_INSERT_GAP(array, nr, at, count, alloc) \
+ do { \
+ ALLOC_GROW((array), (nr) + (count), (alloc)); \
+ MOVE_DOWN((array), (nr), (at), (count)); \
+ } while (0)
Also, count==1 is so frequent that this special case might deserve its
own macro pair.
I'm not inspired by these macro names, though.
Michael
--
Michael Haggerty
mhagger@alum.mit.edu
http://softwareswirl.blogspot.com/
next prev parent reply other threads:[~2014-03-17 15:08 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-08 16:23 git 1.9.0 segfault Guillaume Gelin
2014-03-08 16:46 ` brian m. carlson
2014-03-08 18:12 ` John Keeping
2014-03-08 18:35 ` [PATCH] builtin/mv: fix out of bounds write John Keeping
2014-03-08 19:15 ` brian m. carlson
2014-03-08 19:29 ` [PATCH v2] " John Keeping
2014-03-08 19:21 ` [PATCH] mv: prevent mismatched data when ignoring errors brian m. carlson
2014-03-11 1:56 ` Jeff King
2014-03-11 2:00 ` brian m. carlson
2014-03-11 21:45 ` Junio C Hamano
2014-03-12 23:21 ` brian m. carlson
2014-03-15 16:05 ` Thomas Rast
2014-03-16 2:00 ` Jeff King
2014-03-16 21:20 ` Junio C Hamano
2014-03-17 6:33 ` Junio C Hamano
2014-03-17 15:07 ` Michael Haggerty [this message]
2014-03-17 19:06 ` Eric Sunshine
2014-03-17 22:04 ` Jeff King
2014-03-18 22:31 ` Junio C Hamano
2014-03-15 18:56 ` [PATCH v2] " brian m. carlson
2014-03-16 2:00 ` Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53270FC2.2030701@alum.mit.edu \
--to=mhagger@alum.mit.edu \
--cc=Jens.Lehmann@web.de \
--cc=contact@ramnes.eu \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=john@keeping.me.uk \
--cc=peff@peff.net \
--cc=sandals@crustytoothpaste.net \
--cc=tr@thomasrast.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).