From c506d11aeaad197156070bacff2eb05dd903f253 Mon Sep 17 00:00:00 2001 From: Songstats Audit Date: Sat, 29 Aug 2026 22:11:44 +0200 Subject: [PATCH] Fix buffer pool ownership transfer --- ext/cbor/buffer.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/ext/cbor/buffer.c b/ext/cbor/buffer.c index a39064f..25cebcc 100644 --- a/ext/cbor/buffer.c +++ b/ext/cbor/buffer.c @@ -136,6 +136,12 @@ void msgpack_buffer_mark(msgpack_buffer_t* b) bool _msgpack_buffer_shift_chunk(msgpack_buffer_t* b) { + if(b->rmem_owner == &b->head->mem) { + b->rmem_end = NULL; + b->rmem_last = NULL; + b->rmem_owner = NULL; + } + _msgpack_buffer_chunk_destroy(b->head); if(b->head == &b->tail) { @@ -143,6 +149,9 @@ bool _msgpack_buffer_shift_chunk(msgpack_buffer_t* b) * because head should be always available */ b->tail_buffer_end = NULL; b->read_buffer = NULL; + b->rmem_end = NULL; + b->rmem_last = NULL; + b->rmem_owner = NULL; return false; } @@ -275,6 +284,13 @@ static inline msgpack_buffer_chunk_t* _msgpack_buffer_alloc_new_chunk(msgpack_bu return reuse; } +static inline void _msgpack_buffer_transfer_rmem_owner(msgpack_buffer_t* b, msgpack_buffer_chunk_t* nc) +{ + if(b->rmem_owner == &b->tail.mem) { + b->rmem_owner = &nc->mem; + } +} + static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b) { if(b->head == &b->tail) { @@ -286,6 +302,7 @@ static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b) msgpack_buffer_chunk_t* nc = _msgpack_buffer_alloc_new_chunk(b); *nc = b->tail; + _msgpack_buffer_transfer_rmem_owner(b, nc); b->head = nc; nc->next = &b->tail; @@ -310,6 +327,7 @@ static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b) /* rebuild tail */ *nc = b->tail; + _msgpack_buffer_transfer_rmem_owner(b, nc); before_tail->next = nc; nc->next = &b->tail; } @@ -690,4 +708,3 @@ size_t _msgpack_buffer_skip_from_io(msgpack_buffer_t* b, size_t length) } return RSTRING_LEN(b->io_buffer); } -