Skip to content

Commit 0af338c

Browse files
Fix: Add nullptr guard for sharedData_create and shmctl segment size verification
Address Copilot review feedback: - Add sharedData_create != nullptr check before strncpy/null-termination in all write_SM() overloads to prevent null pointer dereference when shmat() fails in createSharedMemory() - Add shmctl(IPC_STAT) verification in createSharedMemory() to detect stale segments smaller than SHM_SIZE (shmget won't resize existing segments); removes and recreates the segment when too small - Add early return in concore.hpp createSharedMemory() on shmget failure (was missing, unlike concoredocker.hpp which already had it)
1 parent 8d6d989 commit 0af338c

2 files changed

Lines changed: 34 additions & 0 deletions

File tree

concore.hpp

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,20 @@ class Concore{
265265

266266
if (shmId_create == -1) {
267267
std::cerr << "Failed to create shared memory segment." << std::endl;
268+
return;
269+
}
270+
271+
// Verify the segment is large enough (shmget won't resize an existing segment)
272+
struct shmid_ds shm_info;
273+
if (shmctl(shmId_create, IPC_STAT, &shm_info) == 0 && shm_info.shm_segsz < SHM_SIZE) {
274+
std::cerr << "Shared memory segment too small (" << shm_info.shm_segsz
275+
<< " bytes, need " << SHM_SIZE << "). Removing and recreating." << std::endl;
276+
shmctl(shmId_create, IPC_RMID, nullptr);
277+
shmId_create = shmget(key, SHM_SIZE, IPC_CREAT | 0666);
278+
if (shmId_create == -1) {
279+
std::cerr << "Failed to recreate shared memory segment." << std::endl;
280+
return;
281+
}
268282
}
269283

270284
// Attach the shared memory segment to the process's address space
@@ -660,6 +674,8 @@ class Concore{
660674
try {
661675
std::ostringstream outfile;
662676
if(shmId_create != -1){
677+
if (sharedData_create == nullptr)
678+
throw 506;
663679
val.insert(val.begin(),simtime+delta);
664680
outfile<<'[';
665681
for(int i=0;i<val.size()-1;i++)
@@ -697,6 +713,8 @@ class Concore{
697713
this_thread::sleep_for(timespan);
698714
try {
699715
if(shmId_create != -1){
716+
if (sharedData_create == nullptr)
717+
throw 506;
700718
if (val.size() >= SHM_SIZE) {
701719
std::cerr << "ERROR: write_SM payload (" << val.size()
702720
<< " bytes) exceeds " << SHM_SIZE - 1

concoredocker.hpp

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,20 @@ class Concore {
240240
std::cerr << "Failed to create shared memory segment.\n";
241241
return;
242242
}
243+
244+
// Verify the segment is large enough (shmget won't resize an existing segment)
245+
struct shmid_ds shm_info;
246+
if (shmctl(shmId_create, IPC_STAT, &shm_info) == 0 && shm_info.shm_segsz < SHM_SIZE) {
247+
std::cerr << "Shared memory segment too small (" << shm_info.shm_segsz
248+
<< " bytes, need " << SHM_SIZE << "). Removing and recreating.\n";
249+
shmctl(shmId_create, IPC_RMID, nullptr);
250+
shmId_create = shmget(key, SHM_SIZE, IPC_CREAT | 0666);
251+
if (shmId_create == -1) {
252+
std::cerr << "Failed to recreate shared memory segment.\n";
253+
return;
254+
}
255+
}
256+
243257
sharedData_create = static_cast<char*>(shmat(shmId_create, NULL, 0));
244258
if (sharedData_create == reinterpret_cast<char*>(-1)) {
245259
std::cerr << "Failed to attach shared memory segment.\n";
@@ -421,6 +435,8 @@ class Concore {
421435
try {
422436
if (shmId_create == -1)
423437
throw 505;
438+
if (sharedData_create == nullptr)
439+
throw 506;
424440
val.insert(val.begin(), simtime + delta);
425441
std::ostringstream outfile;
426442
outfile << '[';

0 commit comments

Comments
 (0)