Updated copyright notices to include the year 2018.

lib/data-stack - in panic scenarios, use the panic memory buffer Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib/datastack - remove useless thing It was useless. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: Fix logging panic message if data stack canary corruption is detected The previous code just recursed into the same canary corruption check and didn't end up logging anything.

global: Use PRI* macros and %zu instead of casting

lib: remove support for Boehm GC There were several issues with our usage of Boehm GC: - it didn't help with memory fragmentation - it is not very efficient - it was rarely enabled & used Proper use of a GC would involve radical changes to how we write code and cause portability issues. We can get most of the benefits of a GC with data stacks and alloc-only memory pools.

Updated copyright notices to include the year 2017.

global: Make sure *_malloc() calculations won't cause integer overflows.

data-stack: t_push should always keep track of the marker Instead of only keeping track of it on DEBUG builds, t_push should always keep the marker around. This will help diagnosing issues on non-debug builds.

lib-test: Fixed assert-crash in test_exit() with --enable-static-checker Fixes: Panic: Missing t_pop() call

lib: Allow static analyzers to check for t_pop() leaks. They should be able to detect the missing free() call from code paths missing a t_pop().

lib: If DEBUG is enabled, use a pointer type for data_stack_frame_t This allows telling static analyzers to treat t_push() and t_pop() similarly to malloc()/free() and check for leaks.

lib: Changed t_pop() API to make it a bit more like free()

lib: Created data_stack_frame_t type for data_stack_frame

lib: Small code cleanup to data-stack - use explicit data_stack_initialized This will make it easier to change data_stack_frame's type.

lib: Minor t_push() optimization - use unlikely()

lib,lib-test: i_warning to i_debug on alloc growing messages

Remove t_malloc in favour of t_malloc_no0 Using either t_malloc_no0 or t_malloc0 makes it clear whether the allocated memory is zeroed or not.

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

Remove now-unnecessary direct stdlib.h #includes.

lib: data-stack - fix pointer arithmetic compiler warning Clang's -fsanitize=unsigned-integer-overflow barfs as follows: data-stack.c:477:29: runtime error: negation of 8 cannot be represented in type 'unsigned long' data-stack.c:495:15: runtime error: negation of 8 cannot be represented in type 'unsigned long' Which is of course complete bollocks. There is no 8, there's only an 8ul, and the negation of 8ul is 0xfffffff8ul (or a wider equivalent). That's the law. However, the pointer arithmetic which follows the negation, whilst almost certainly working in practice, is probably bogus, so just make the thing signed before the negation, and both problems go away. Reported-by: Teemu Huovila <teemu.huovila@dovecot.fi> Signed-off-by: Phil Carmody <phil@dovecot.fi>

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - start sentry checks immediately after the reserved buffer Our sentries are written with byte-precision, no need to round up before doing the checks. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - add DEBUG size and sentry updating to t_try_realloc Without this, t_pop() will report errors. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - fix incorrect pointer comparison in t_try_realloc in DEBUG builds When trying to work out if it's a valid realloc, we need to remember that in DEBUG builds, we have hidden a size value (in a MEM_ALIGNED space) before the pointer we return. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - fix realloc/lowwater bug If DEBUG is enabled, then it can try to look past the low-water mark as the low-water mark wasn't moved during successful reallocs. This condition is detected, and causes a panic. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - t_try_realloc get alloc size right in DEBUG builds Also introduce a helper variable for the common expression for readability. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - helper for last alloc ends at block.data+(size-left) Less to read, and less noisy. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - add vital sanity-preserving assert to t_pop If something has re-ordered those two offsets, the following memset will explode. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - pull common code out of if/else branches in t_malloc_real Once the new block is set up nicely empty for use, it can be used exactly like an old block that has enough space - so just merge the code paths. (This changeset best viewed ignoring whitespace.) Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - reorder full current block code Make the "enough space" and "block is full" branches in t_malloc_real have the same code structure for parallelism. The 'block' variable is only needed very locally, so shrink its scope, and avoid its use once it is assigned to current_block, use that instead. Compacter readable expressions have been favoured at the expense of longer lines (which will soon shrink). Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - helper macro for requested/allocated size Rather than #if/#else/#endif around such calculations, or even having the possibility to mistype such expressions, just extract the calculation into a helper macro defined appropriately for the DEBUG mode. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - disambiguate sizes in t_pop_verify In DEBUG mode, the allocated size is bigger than the requested size, so rename the variable to reflect its real meaning, and move it into a tighter scope in the process. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - simplify expressions in data_stack_last_buffer_reset Noisy expression used more than once, give it a meaningful name. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: data-stack - enable tighter sanity checks on stack_block allocations The canary doesn't have to be NULL. That's only effective if it will be read and dereferenced as a pointer. If used as an integer, it's a perfectly boring one, and not likely to draw attention to itself. Once the canary is in place, at least in debug mode, we can check it in every function as a sanity check. Make our poison stand out from other poison used elsewhere in the code. Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: cosmetic - whitespace cleanup in allocator/memory-related code Indentation used spaces. Some trailing whitespace found. $ git diff -w $ Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: add rudementary statistics gathering to data-stack debugging These currently just enhance the overly-large alloc_size warning message in t_malloc_real() to show what the history of allocations is. New warnings look like this: Warning: Growing data stack by 32768 as 'test_run_funcs' reaches 16416 bytes from 202 allocations. Future possible directions: t_malloc_real() could be further modified to identify badly-behaved regions of code that allocate lots of smaller blocks as it happens (which might be noisy). t_pop() could be modified to detect such code after it exits its block (so just one warning per instance of misbehaviour). Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib: add markers to data-stack debug prints Only the DEBUG code will have access to the frame's marker.

lib: add identifying markers to data-stack frames Add a string parameter to t_push() so that in DEBUG mode, misbehaviour inside a stack level can be blamed on someone. Default the T_BEGIN macro to automatigally use __FUNCTION__ or __FILE__:__LINE__ as that identifier, therefore no clients of those macros need to change. ioloop used t_push() directly as it wanted customised diagnostic strings. To preserve this friendliness, also introduce a t_push_named() which takes a format string with paramters. Apart from the unused paramter, a non-DEBUG build should see no changes. Signed-off-by: Phil Carmody <phil@dovecot.fi>

DEBUG: Make sure errno isn't changed by vsnprintf()/malloc()/free() implementations. They shouldn't, so this should only be a sanity check when running with devel-checks. Various parts in the code rely on errno not being changed by *_strdup_printf() calls.

Updated copyright notices to include year 2014.

Data stack has now an extra NULL pointer padding before its actual data starts. This is just an extra safety measure against buffer overflows. Patch by Jann Horn.

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.