Downloafy/suyu-forked
1
0
Fork 1
forked from suyu/suyu
Code Pull requests 1 Activity

common: tree: Avoid a crash on nullptr dereference.

Browse source
This commit is contained in:
bunnei 2021-05-16 00:54:15 -07:00
parent 7361eac10f
commit 342170fcd3
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/common/tree.h
View file

@ -43,6 +43,8 @@
* The maximum height of a red-black tree is 2lg (n+1). * The maximum height of a red-black tree is 2lg (n+1).
*/ */
#include "common/assert.h"
namespace Common { namespace Common {
template <typename T> template <typename T>
class RBHead { class RBHead {
@ -325,6 +327,10 @@ void RB_REMOVE_COLOR(RBHead<Node>* head, Node* parent, Node* elm) {
while ((elm == nullptr || RB_IS_BLACK(elm)) && elm != head->Root() && parent != nullptr) { while ((elm == nullptr || RB_IS_BLACK(elm)) && elm != head->Root() && parent != nullptr) {
if (RB_LEFT(parent) == elm) { if (RB_LEFT(parent) == elm) {
tmp = RB_RIGHT(parent); tmp = RB_RIGHT(parent);
if (!tmp) {
ASSERT_MSG(false, "tmp is invalid!");
break;
}
if (RB_IS_RED(tmp)) { if (RB_IS_RED(tmp)) {
RB_SET_BLACKRED(tmp, parent); RB_SET_BLACKRED(tmp, parent);
RB_ROTATE_LEFT(head, parent, tmp); RB_ROTATE_LEFT(head, parent, tmp);
@ -366,6 +372,11 @@ void RB_REMOVE_COLOR(RBHead<Node>* head, Node* parent, Node* elm) {
tmp = RB_LEFT(parent); tmp = RB_LEFT(parent);
} }
if (!tmp) {
ASSERT_MSG(false, "tmp is invalid!");
break;
}
if ((RB_LEFT(tmp) == nullptr || RB_IS_BLACK(RB_LEFT(tmp))) && if ((RB_LEFT(tmp) == nullptr || RB_IS_BLACK(RB_LEFT(tmp))) &&
(RB_RIGHT(tmp) == nullptr || RB_IS_BLACK(RB_RIGHT(tmp)))) { (RB_RIGHT(tmp) == nullptr || RB_IS_BLACK(RB_RIGHT(tmp)))) {
RB_SET_COLOR(tmp, EntryColor::Red); RB_SET_COLOR(tmp, EntryColor::Red);