Skip to content

Incorrect pointer arithmetic in amdb_load_unload_modules due to operator precedence #96

Description

@yungng-lab

according memory allocation

h_info_size          = (payload_ptr->num_modules) * (sizeof(spf_list_node_t) + sizeof(amdb_module_handle_info_t));
alloc_size           = sizeof(amdb_context_t) + h_info_size;

In the amdb_load_unload_modules function (line ~287), there is a pointer arithmetic bug caused by operator precedence:

h_info_list = (spf_list_node_t *)context_ptr + 1;

The code should first perform pointer arithmetic on context_ptr (advancing by sizeof(amdb_context_t) to reach the memory location after the amdb_context_t structure), then cast the result to spf_list_node_t *

h_info_list = (spf_list_node_t *)(context_ptr + 1);

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions