Re: libevent: Protect integer multiplications (min_heap)

[Ted Unangst]

Theo de Raadt wrote:
> So the diff presented falls short of what should be done here;
> insufficient lines deleted.

we're not getting to the fun part yet, but this unfold some complex operations
to assist human readers.

-        min_child -= min_child == s->n || 
min_heap_elem_greater(s->p[min_child], s->p[min_child - 1]);
+       if (min_child == s->n ||
+           min_heap_elem_greater(s->p[min_child], s->p[min_child - 1]))
+               min_child -= 1;

that one really stands out as kinda not the normal way of doing things.

(and then reformat to be knf, but after changes that require review.)

Index: min_heap.h
===================================================================
RCS file: /home/cvs/src/lib/libevent/min_heap.h,v
retrieving revision 1.3
diff -u -p -r1.3 min_heap.h
--- min_heap.h  29 Oct 2014 22:47:29 -0000      1.3
+++ min_heap.h  17 Apr 2019 15:30:02 -0000
@@ -112,7 +112,7 @@ int min_heap_reserve(min_heap_t* s, unsi
         unsigned a = s->a ? s->a * 2 : 8;
         if(a < n)
             a = n;
-        if(!(p = (struct event**)realloc(s->p, a * sizeof *p)))
+        if(!(p = realloc(s->p, a * sizeof *p)))
             return -1;
         s->p = p;
         s->a = a;
@@ -125,11 +125,13 @@ void min_heap_shift_up_(min_heap_t* s, u
     unsigned parent = (hole_index - 1) / 2;
     while(hole_index && min_heap_elem_greater(s->p[parent], e))
     {
-        (s->p[hole_index] = s->p[parent])->min_heap_idx = hole_index;
+        s->p[hole_index] = s->p[parent];
+        s->p[hole_index]->min_heap_idx = hole_index;
         hole_index = parent;
         parent = (hole_index - 1) / 2;
     }
-    (s->p[hole_index] = e)->min_heap_idx = hole_index;
+    e->min_heap_idx = hole_index;
+    s->p[hole_index] = e;
 }
 
 void min_heap_shift_down_(min_heap_t* s, unsigned hole_index, struct event* e)
@@ -137,10 +139,13 @@ void min_heap_shift_down_(min_heap_t* s,
     unsigned min_child = 2 * (hole_index + 1);
     while(min_child <= s->n)
        {
-        min_child -= min_child == s->n || 
min_heap_elem_greater(s->p[min_child], s->p[min_child - 1]);
+       if (min_child == s->n ||
+           min_heap_elem_greater(s->p[min_child], s->p[min_child - 1]))
+               min_child -= 1;
         if(!(min_heap_elem_greater(e, s->p[min_child])))
             break;
-        (s->p[hole_index] = s->p[min_child])->min_heap_idx = hole_index;
+        s->p[hole_index] = s->p[min_child];
+        s->p[hole_index]->min_heap_idx = hole_index;
         hole_index = min_child;
         min_child = 2 * (hole_index + 1);
        }