Commit b666f286 authored by Josh Bleecher Snyder's avatar Josh Bleecher Snyder

runtime: use 64 bit calculation in overLoadFactor

overLoadFactor used a uintptr for its calculations.
When the number of potential buckets was large,
perhaps due to a coding error or corrupt/malicious user input
leading to a very large map size hint,
this led to overflow on 32 bit systems.
This overflow resulted in an infinite loop.

Prevent it by always using a 64 bit calculation.

Updates #20195

Change-Id: Iaabc710773cd5da6754f43b913478cc5562d89a2
Reviewed-on: https://go-review.googlesource.com/42185
Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarKeith Randall <khr@golang.org>
parent 00db0cbf
...@@ -985,7 +985,7 @@ func hashGrow(t *maptype, h *hmap) { ...@@ -985,7 +985,7 @@ func hashGrow(t *maptype, h *hmap) {
// overLoadFactor reports whether count items placed in 1<<B buckets is over loadFactor. // overLoadFactor reports whether count items placed in 1<<B buckets is over loadFactor.
func overLoadFactor(count int64, B uint8) bool { func overLoadFactor(count int64, B uint8) bool {
// TODO: rewrite to use integer math and comparison? // TODO: rewrite to use integer math and comparison?
return count >= bucketCnt && float32(count) >= loadFactor*float32((uintptr(1)<<B)) return count >= bucketCnt && float32(count) >= loadFactor*float32((uint64(1)<<B))
} }
// tooManyOverflowBuckets reports whether noverflow buckets is too many for a map with 1<<B buckets. // tooManyOverflowBuckets reports whether noverflow buckets is too many for a map with 1<<B buckets.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment