Skip to content

Commit 437981f

Browse files
committed
Ensure root safety in caml_register_named_value.
1 parent c67b183 commit 437981f

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

runtime/callback.c

+7-5
Original file line numberDiff line numberDiff line change
@@ -386,32 +386,34 @@ static unsigned int hash_value_name(char const *name)
386386

387387
CAMLprim value caml_register_named_value(value vname, value val)
388388
{
389+
CAMLparam2(vname, val);
389390
const char * name = String_val(vname);
390391
unsigned int h = hash_value_name(name);
391392
int found = 0;
392393

393394
caml_plat_lock_non_blocking(&named_value_lock);
395+
name = NULL; /* block may have moved while we waited for the lock. */
394396
for (struct named_value *nv = named_value_table[h];
395397
nv != NULL;
396398
nv = nv->next) {
397-
if (strcmp(name, nv->name) == 0) {
399+
if (strcmp(String_val(vname), nv->name) == 0) {
398400
caml_modify_generational_global_root(&nv->val, val);
399401
found = 1;
400402
break;
401403
}
402404
}
403405
if (!found) {
404-
size_t namelen = strlen(name) + 1;
406+
size_t namelen = strlen(String_val(vname));
405407
struct named_value * nv =
406-
caml_stat_alloc(sizeof(struct named_value) + namelen);
407-
memcpy(nv->name, name, namelen);
408+
caml_stat_alloc(sizeof(struct named_value) + namelen + 1);
409+
memcpy(nv->name, String_val(vname), namelen + 1);
408410
nv->val = val;
409411
nv->next = named_value_table[h];
410412
named_value_table[h] = nv;
411413
caml_register_generational_global_root(&nv->val);
412414
}
413415
caml_plat_unlock(&named_value_lock);
414-
return Val_unit;
416+
CAMLreturn(Val_unit);
415417
}
416418

417419
CAMLexport const value* caml_named_value(char const *name)

0 commit comments

Comments
 (0)