[Bug 281483] [librt] timer_delete segfaults with incorrect timer id

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281483

John Baldwin <jhb@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |Works As Intended
             Status|New                         |Closed
                 CC|                            |jhb@FreeBSD.org

--- Comment #1 from John Baldwin <jhb@FreeBSD.org> ---
Hardcoding 0 as an argument to timer_delete() is undefined behavior.  From
https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_delete.html:

<quote>
The behavior is undefined if the value specified by the timerid argument to
timer_delete() does not correspond to a timer ID returned by timer_create() but
not yet deleted by timer_delete().
</quote>

It is true that later in the same page, it recommends returning EINVAL if a bad
timer_t value is detected, but we cannot reliably detect double free which
would be the more common error.  Hardcoding a constant 0 is not portable.

-- 
You are receiving this mail because:
You are the assignee for the bug.