The array is allocated by the *caller*, not the callee, and then filled
by the callee during the call.
Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
We don’t want `CONTRIBUTING.md` to become an exhaustive manual of how to
contribute to what is a fairly standard C project using Meson, but it is
a fairly helpful hint to mention how to run the test suite. Then people
can use `meson test --help` and the Meson documentation to learn more.
Pointed out on !4589.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Add an internal helper for `g_checksum_update()` to avoid having to take
its length as a `gssize` for internal users who already know the input
length.
Fixes a `-Wsign-conversion` warning.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
The code wasn’t written for it, and we don’t want to diverge from
upstream for this, so disable -Wsign-conversion in case it was set for
the overall GLib build.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
The parser was assuming that all three separators (`_@.`) were in order;
but the input might not contain them in order. In that case, the parser
would have passed negative values to `g_strndup()` which would have been
implicitly cast to large positive values, and potentially exposed a lot
of memory (until the first nul byte, which was probably quite soon).
Expand the existing `g_get_locale_variants()` test to cover some invalid
parsing, and add a fuzzing test too.
Spotted by `-Wsign-conversion`.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
It's expected that an interface may have a NULL socket address, so just
skip it and don't crash if so. In practice, this occurs for VPN
interfaces.
Fixes: fe0139ee985075f3c12932d7123cb594356e7e9d
Thankfully this struct is also internal, so we can happily change the
types of any field except the first one (which is in the public `GTuples`
prefix).
This fixes the remaining `-Wsign-conversion` warnings for `grel.c`.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
`GTuples.len` is a `guint`.
This doesn’t seem to have caused any problems or warnings, but let’s get
it correct.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
We would otherwise have to have cast and lost width and signedness on
both the arguments to, and return value from, `g_relation_count()`.
Simpler to add an internal helper with the right types, and only do the
casts on the public API wrapper where API stability means it’s
unavoidable.
Fixes some more `-Wsign-conversion` warnings.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
Previously this was passed straight into an array dereference, so could
easily have under- or over-flowed the array.
Add a precondition check to it. This doesn’t change the API contract,
because the code already emitted a critical warning if the index didn’t
find a table:
```
g_return_val_if_fail (table != NULL, NULL)
```
This fixes a load of `-Wsign-conversion` warnings and makes these
functions safer.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
This is what’s documented as supported (and the only value that is
supported), so might as well check for it early.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
The internals of this struct are private, so we have some freedom to fix
the types used to be wider (to allow addressing all of memory) and
correctly unsigned.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
The code wasn’t written for it, and we don’t want to diverge from
upstream for this, so disable -Wsign-conversion in case it was set for
the overall GLib build.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3405
Wherever we use gssize to allow passing -1, we need to ensure we don't
overflow the value by assigning a gsize to it without checking if the
size exceeds the maximum gssize. The safest way to do this is to just
use normal gsize everywhere instead and use gssize only for the
parameter.
Our computers don't have enough RAM to write tests for this. I tried
forcing string->len to high values for test purposes, but this isn't
valid and will just cause out of bounds reads/writes due to
string->allocated_len being unexpectedly small, so I don't think we can
test this easily.
Make it a bit clearer that a returned `GFileInfo` can be empty if
`stat()` fails (e.g. with `EACCES`), and that it’s the caller’s
responsibility to use `g_file_info_has_attribute()` before retrieving
attribute values.
This better documents what we implemented in, for example, !3336.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Helps: #3658
It probably would get inlined anyway(?). But add G_ALWAYS_INLINE
to be more sure about this. We don't want this mostly trivial
function to be a separate call.
These are similar to g_pointer_bit_lock_and_get() and
g_pointer_bit_unlock_and_set().
The bitlock API is pretty amazing, as it allows to use a single bit of
an integer for locking while using the remaining 31 bits for other
purposes. But those other bits always need to be accessed atomically
too.
There is a use in being able to lock_and_get(), to combine the setting
of the lock bit and fetching the new value at once. For one, that can
safe additional atomic operations to fetch the value afterwards. But
more importantly, it allows to do this change in one atomic operation.
Likewise, unlock_and_set() allows to atomically clear the lock bit and
set a new value (while also preserving unrelated bits, by using the
@preserve_mask parameter).
With the previous changes, all accesses to the WeakRefStack go through
g_datalist_id_update_atomic() and are guarded by the GData's bit lock.
At this point, the OPTIONAL_BIT_LOCK_WEAK_REFS lock is unnecessary and
can be dropped.
A minor benefit is that g_object_weak_{ref,unref}() needs now one lock
less.
Also note that this rework fixes a potential race for weak refs. Note
that we have two calls
g_datalist_id_set_data (&object->qdata, quark_weak_notifies, NULL);
that don't take OPTIONAL_BIT_LOCK_WEAK_REFS lock. One of these calls is
right before finalize(). At that point, no other thread can hold a
reference to the object to race and we are good. However, the other call
is from g_object_real_dispose(). At that point, theoretically the object
could have been resurrected and a pointer could have been passed to
another thread. Calling then g_object_weak_ref()/g_object_weak_unref()
will race. We would have required a OPTIONAL_BIT_LOCK_WEAK_REFS lock
around those g_datalist_id_set_data(,,NULL) calls.
Instead, this is now also fixed, because every update to the
WeakRefStack happens while holding the GData lock. So if you call
g_datalist_id_set_data(,,NULL), the WeakRefStack is removed from the
GData (and later freed by weak_refs_notify() and can no longer
concurrently updated by g_object_weak_{ref,unref}().
This is a step step to drop OPTIONAL_BIT_LOCK_WEAK_REFS lock. See the
next commits why that is done.
Also, free the WeakRefStack, if there are no more references.
Previously, it was never freed.
The usual macro for Linux is `__linux__`, not `__LINUX__`. Noticed this
after Ruby fixed a similar error (6fbc32b5d0da31535cccc0eca1853273313a0b52).
Fixes: 5b84636e62d2c77ad4fee49742750a3df762736c
