Date: Fri, 20 Sep 2024 14:38:27 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 281483] [librt] timer_delete segfaults with incorrect timer id Message-ID: <bug-281483-227-R0epGY91S9@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-281483-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281483 John Baldwin <jhb@FreeBSD.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |Works As Intended Status|New |Closed CC| |jhb@FreeBSD.org --- Comment #1 from John Baldwin <jhb@FreeBSD.org> --- Hardcoding 0 as an argument to timer_delete() is undefined behavior. From https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_delete.html: <quote> The behavior is undefined if the value specified by the timerid argument to timer_delete() does not correspond to a timer ID returned by timer_create() but not yet deleted by timer_delete(). </quote> It is true that later in the same page, it recommends returning EINVAL if a bad timer_t value is detected, but we cannot reliably detect double free which would be the more common error. Hardcoding a constant 0 is not portable. -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-281483-227-R0epGY91S9>