From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Thu, 17 Sep 2026 23:47:35 +0000 (-0700)
Subject: Memory pool: compare block addresses without overflow
X-Git-Tag: 1.0.2~35
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=90ae2f41bd9170dff5402def63fba38b474abdea;p=njs.git

Memory pool: compare block addresses without overflow

Previously, the rbtree comparator converted the difference between two
addresses to intptr_t.  On 32-bit systems, addresses that differ by at
least 2 GiB could produce an incorrect ordering and prevent a later block
lookup from finding its cluster.

The fix is to compare the addresses directly and return -1, 0, or 1.
This fixes a pool that remained non-empty after all allocations were freed
in the x86 memory pool test.
---

diff --git a/src/njs_mp.c b/src/njs_mp.c
index f7e0df1d..f1d464a3 100644
--- a/src/njs_mp.c
+++ b/src/njs_mp.c
@@ -647,12 +647,16 @@ njs_mp_alloc_large(njs_mp_t *mp, size_t alignment, size_t size)
 static intptr_t
 njs_mp_rbtree_compare(njs_rbtree_node_t *node1, njs_rbtree_node_t *node2)
 {
+    uintptr_t        start1, start2;
     njs_mp_block_t  *block1, *block2;
 
     block1 = (njs_mp_block_t *) node1;
     block2 = (njs_mp_block_t *) node2;
 
-    return (uintptr_t) block1->start - (uintptr_t) block2->start;
+    start1 = (uintptr_t) block1->start;
+    start2 = (uintptr_t) block2->start;
+
+    return (start1 > start2) - (start1 < start2);
 }