Skip to content

Commit dd3aa18

Browse files
authored
Fix incorrect check in fpm_shm_free() (#13797)
`if (fpm_shm_size - size > 0)` will be rewritten by the compiler as this: `if (fpm_shm_size != size)`, which is undesirable. The reason this happens is that both variables are size_t, so subtracting them cannot be negative. The only way it can be not > 0, is if they're equal because the result will then be 0. This means that the else branch won't work properly. E.g. if `fpm_shm_size == 50` and `size == 51`, then `fpm_shm_size` will wraparound instead of becoming zero. To showcase that the compiler actually does this, take a look at this isolated case: https://godbolt.org/z/azobdWcrY. Here we can see the usage of the compare instruction + cmove, so the "then" branch is only done if the variables are equal.
1 parent 6f11cc4 commit dd3aa18

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

sapi/fpm/fpm/fpm_shm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ int fpm_shm_free(void *mem, size_t size) /* {{{ */
5050
return 0;
5151
}
5252

53-
if (fpm_shm_size - size > 0) {
53+
if (fpm_shm_size > size) {
5454
fpm_shm_size -= size;
5555
} else {
5656
fpm_shm_size = 0;

0 commit comments

Comments
 (0)