...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <glib.h> #include <glib-object.h> typedef struct Nodenode_s { void *data; Node *next; } Node; typedef struct Queuequeue_s { Node *head; Node *tail; } Queue; Queue* queue_new(void) { Queue *q = g_slice_new( sizeof(Queue)); q->head = q->tail = g_slice_new0( sizeof(Node)); return q; } void queue_enqueue(Queue *q, gpointer data) { Node *node; Node *tail; Node *next; node = g_slice_new(Node); node->data = data; node->next = NULL; while (TRUE) { tail = q->tail; next = tail->next; if (tail != q->tail) { continue; } if (next != NULL) { CAS(&q->tail, tail, next); continue; } if (CAS( &tail->next, null, node)) { break; } } CAS(&q->tail, tail, node); } gpointer queue_dequeue(Queue *q) { Node *node; Node *tail; Node *next; while (TRUE) { head = q->head; tail = q->tail; next = head->next; if (head != q->head) { continue; } if (next == NULL) { return NULL; // Empty } if (head == tail) { CAS(&q->tail, tail, next); continue; } data = next->data; if (CAS(&q->head, head, next)) { break; } } g_slice_free(Node, head); return data; } |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
// Hazard Pointers Types and Structure
structure HPRecType {
HP[K]:*Nodetype; Next:*HPRecType;}
// The header of the HPRec list
HeadHPRec: *HPRecType;
// Per-thread private variables
rlist: listType; // initially empty
rcount: integer; // initially 0
//The Retired Node routine
RetiredNode(node:*NodeType) {
rlist.push(node);
rcount++;
if(rcount >= R)
Scan(HeadHPRec);
}
// The scan routine
Scan(head:*HPRecType) {
// Stage1: Scan HP list and insert non-null values in plist
plist.init();
hprec<-head;
while (hprec != null) {
for (i<-0 to K-1) {
hptr<-hprec^HP[i];
if (hptr!= null)
plist.insert(hptr);
}
hprec<-hprec^Next;
}
// Stage 2: search plist
tmplist<-rlist.popAll();
rcount<-0;
node<-tmplist.pop();
while (node != null) {
if (plist.lookup(node)) {
rlist.push(node);
rcount++;
}
else {
PrepareForReuse(node);
}
node<-tmplist.pop();
}
plist.free();
}
|
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <glib-object.h> typedef struct Nodenode_s { void *data; Node *next; } Node; typedef struct Queuequeue_s { Node *head; Node *tail; mtx_t mutex; } Queue; Queue* queue_new(void) { Queue *q = g_slice_new( sizeof(Queue)); q->head = q->tail = g_slice_new0( sizeof(Node)); return q; } void queue_enqueue(Queue *q, gpointer data) { Node *node; Node *tail; Node *next; // Lock the queue before accessing the contents mtx_lock(&(q->mutex)); node = g_slice_new(Node); node->data = data; node->next = NULL; if(q->head == NULL) { q->head = node; q->tail = node; } else { q->tail->next = node; q->tail = node; } // Unlock the mutex mtx_unlock(&(queue->mutex)); } gpointer queue_dequeue(Queue *q) { Node *node; Node *tail; Node *next; mtx_lock(&(q->mutex)); head = q->head; tail = q->tail; next = head->next; data = next->data; q->head = next; g_slice_free(Node, head); mtx_unlock(&(queue->mutex)); return data; } |
...
The likelihood of having a race condition is low. Once the race condition occurs, the reading memory that has already been freed can lead to abnormal program termination or unintended information disclosure.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
CON39-C | Medium | unlikely | High | P2 | L3 |
...