spapr: fix buffer-overflow

[mirror_qemu.git] / util / buffer.c

diff --git a/util/buffer.c b/util/buffer.c
index 234e33d5c1692a8c5eb05098f7356cd1e630a20e..d8bb8745343dc58004dbb69549f8796bba33dbf8 100644 (file)
--- a/util/buffer.c
+++ b/util/buffer.c
@@ -18,11 +18,39 @@
  *
  */
 
+#include "qemu/osdep.h"
+#include "qemu/host-utils.h"
 #include "qemu/buffer.h"
+#include "trace.h"
 
 #define BUFFER_MIN_INIT_SIZE     4096
 #define BUFFER_MIN_SHRINK_SIZE  65536
 
+/* define the factor alpha for the exponential smoothing
+ * that is used in the average size calculation. a shift
+ * of 7 results in an alpha of 1/2^7. */
+#define BUFFER_AVG_SIZE_SHIFT       7
+
+static size_t buffer_req_size(Buffer *buffer, size_t len)
+{
+    return MAX(BUFFER_MIN_INIT_SIZE,
+               pow2ceil(buffer->offset + len));
+}
+
+static void buffer_adj_size(Buffer *buffer, size_t len)
+{
+    size_t old = buffer->capacity;
+    buffer->capacity = buffer_req_size(buffer, len);
+    buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
+    trace_buffer_resize(buffer->name ?: "unnamed",
+                        old, buffer->capacity);
+
+    /* make it even harder for the buffer to shrink, reset average size
+     * to current capacity if it is larger than the average. */
+    buffer->avg_size = MAX(buffer->avg_size,
+                           buffer->capacity << BUFFER_AVG_SIZE_SHIFT);
+}
+
 void buffer_init(Buffer *buffer, const char *name, ...)
 {
     va_list ap;
@@ -32,29 +60,38 @@ void buffer_init(Buffer *buffer, const char *name, ...)
     va_end(ap);
 }
 
+static uint64_t buffer_get_avg_size(Buffer *buffer)
+{
+    return buffer->avg_size >> BUFFER_AVG_SIZE_SHIFT;
+}
+
 void buffer_shrink(Buffer *buffer)
 {
-    /*
-     * Only shrink in case the used size is *much* smaller than the
-     * capacity, to avoid bumping up & down the buffers all the time.
-     * realloc() isn't exactly cheap ...
-     */
-    if (buffer->offset < (buffer->capacity >> 3) &&
-        buffer->capacity > BUFFER_MIN_SHRINK_SIZE) {
-        return;
+    size_t new;
+
+    /* Calculate the average size of the buffer as
+     * avg_size = avg_size * ( 1 - a ) + required_size * a
+     * where a is 1 / 2 ^ BUFFER_AVG_SIZE_SHIFT. */
+    buffer->avg_size *= (1 << BUFFER_AVG_SIZE_SHIFT) - 1;
+    buffer->avg_size >>= BUFFER_AVG_SIZE_SHIFT;
+    buffer->avg_size += buffer_req_size(buffer, 0);
+
+    /* And then only shrink if the average size of the buffer is much
+     * too big, to avoid bumping up & down the buffers all the time.
+     * realloc() isn't exactly cheap ...  */
+    new = buffer_req_size(buffer, buffer_get_avg_size(buffer));
+    if (new < buffer->capacity >> 3 &&
+        new >= BUFFER_MIN_SHRINK_SIZE) {
+        buffer_adj_size(buffer, buffer_get_avg_size(buffer));
     }
 
-    buffer->capacity = pow2ceil(buffer->offset);
-    buffer->capacity = MAX(buffer->capacity, BUFFER_MIN_SHRINK_SIZE);
-    buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
+    buffer_adj_size(buffer, 0);
 }
 
 void buffer_reserve(Buffer *buffer, size_t len)
 {
     if ((buffer->capacity - buffer->offset) < len) {
-        buffer->capacity = pow2ceil(buffer->offset + len);
-        buffer->capacity = MAX(buffer->capacity, BUFFER_MIN_INIT_SIZE);
-        buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
+        buffer_adj_size(buffer, len);
     }
 }
 
@@ -71,10 +108,12 @@ uint8_t *buffer_end(Buffer *buffer)
 void buffer_reset(Buffer *buffer)
 {
     buffer->offset = 0;
+    buffer_shrink(buffer);
 }
 
 void buffer_free(Buffer *buffer)
 {
+    trace_buffer_free(buffer->name ?: "unnamed", buffer->capacity);
     g_free(buffer->buffer);
     g_free(buffer->name);
     buffer->offset = 0;
@@ -94,10 +133,14 @@ void buffer_advance(Buffer *buffer, size_t len)
     memmove(buffer->buffer, buffer->buffer + len,
             (buffer->offset - len));
     buffer->offset -= len;
+    buffer_shrink(buffer);
 }
 
 void buffer_move_empty(Buffer *to, Buffer *from)
 {
+    trace_buffer_move_empty(to->name ?: "unnamed",
+                            from->offset,
+                            from->name ?: "unnamed");
     assert(to->offset == 0);
 
     g_free(to->buffer);
@@ -117,6 +160,9 @@ void buffer_move(Buffer *to, Buffer *from)
         return;
     }
 
+    trace_buffer_move(to->name ?: "unnamed",
+                      from->offset,
+                      from->name ?: "unnamed");
     buffer_reserve(to, from->offset);
     buffer_append(to, from->buffer, from->offset);