[Bug 281483] [librt] timer_delete segfaults with incorrect timer id
- In reply to: bugzilla-noreply_a_freebsd.org: "[Bug 281483] [librt] timer_delete segfaults with incorrect timer id"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 20 Sep 2024 14:38:27 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281483 John Baldwin <jhb@FreeBSD.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |Works As Intended Status|New |Closed CC| |jhb@FreeBSD.org --- Comment #1 from John Baldwin <jhb@FreeBSD.org> --- Hardcoding 0 as an argument to timer_delete() is undefined behavior. From https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_delete.html: <quote> The behavior is undefined if the value specified by the timerid argument to timer_delete() does not correspond to a timer ID returned by timer_create() but not yet deleted by timer_delete(). </quote> It is true that later in the same page, it recommends returning EINVAL if a bad timer_t value is detected, but we cannot reliably detect double free which would be the more common error. Hardcoding a constant 0 is not portable. -- You are receiving this mail because: You are the assignee for the bug.