@@ -344,17 +344,26 @@ static LispPTR linkblock(LispPTR base) {
344344
345345LispPTR makefreearrayblock (LispPTR block , DLword length ) {
346346 LispPTR trailer ;
347- struct arrayblock * bbase ;
348- struct abdum * dbase ;
349- bbase = (struct arrayblock * )NativeAligned4FromLAddr (block );
350- dbase = (struct abdum * )WORDPTR (bbase );
351- dbase -> abflags = FREEARRAYFLAGWORD ;
352- bbase -> arlen = length ;
353- trailer = Trailer (block , bbase );
354- bbase = (struct arrayblock * )NativeAligned4FromLAddr (trailer );
355- dbase = (struct abdum * )WORDPTR (bbase );
356- dbase -> abflags = FREEARRAYFLAGWORD ;
357- bbase -> arlen = length ;
347+ struct arrayblock * block_np , * trailer_np ;
348+ struct abdum * flags_np ;
349+ block_np = (struct arrayblock * )NativeAligned4FromLAddr (block );
350+ /* this is an appropriate place to test whether the block that
351+ is about to be freed contains words that look like valid
352+ array header/trailer pairs as data. This may result in
353+ false positives, but could help if there's a real smash happening.
354+ */
355+ /* struct abdum's abflags is a DLword and does not account for
356+ the BYTESWAP setup (as arrayblock does), so use WORDPTR to
357+ pick the correct word of the cell
358+ */
359+ flags_np = (struct abdum * )WORDPTR (block_np );
360+ flags_np -> abflags = FREEARRAYFLAGWORD ;
361+ block_np -> arlen = length ;
362+ trailer = Trailer (block , block_np );
363+ trailer_np = (struct arrayblock * )NativeAligned4FromLAddr (trailer );
364+ flags_np = (struct abdum * )WORDPTR (trailer_np );
365+ flags_np -> abflags = FREEARRAYFLAGWORD ;
366+ trailer_np -> arlen = length ;
358367 return (block );
359368}
360369
0 commit comments