From d340aac2ebdb6a6360ac1c748daf501bd96abf88 Mon Sep 17 00:00:00 2001
From: Bill Currie <bill@taniwha.org>
Date: Tue, 4 Dec 2012 13:40:00 +0900
Subject: [PATCH] Fix the bugs marked in defspace.h

Now size is checked properly for defspace_free_loc and defspace_alloc_loc,
and defspace_alloc_loc check's grow()'s return value.
---
 tools/qfcc/include/defspace.h | 8 ++------
 tools/qfcc/source/defspace.c  | 9 +++++----
 tools/qfcc/source/linker.c    | 3 ++-
 3 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/tools/qfcc/include/defspace.h b/tools/qfcc/include/defspace.h
index f2148802d..b2d3aadeb 100644
--- a/tools/qfcc/include/defspace.h
+++ b/tools/qfcc/include/defspace.h
@@ -57,9 +57,8 @@ typedef struct defspace_s {
 		be allocated and an internal error will be generated.
 
 		\param space	This defspace.
-		\return			1 for success, 0 for failure.
-
-		\bug The return value is ignored.
+		\return			1 for success, 0 for failure. On failure, an internal
+						error will be generated.
 	*/
 	int       (*grow) (struct defspace_s *space);
 	int         qfo_space;		///< index to space in qfo spaces
@@ -91,7 +90,6 @@ defspace_t *defspace_new (void);
 	\return			The offset of the first word of the freshly allocated
 					space. May be 0 if the allocated space is at the beginning
 					of the defspace.
-	\bug does not check for allocating 0 (or negative) words.
 */
 int defspace_alloc_loc (defspace_t *space, int size);
 
@@ -113,8 +111,6 @@ int defspace_alloc_loc (defspace_t *space, int size);
 	\param space	The space to which the freed block will be returned.
 	\param ofs		The first word of the block to be freed.
 	\param size		The number of words in the block to be freed.
-
-	\bug \a size is not checked for being negative.
 */
 void defspace_free_loc (defspace_t *space, int ofs, int size);
 
diff --git a/tools/qfcc/source/defspace.c b/tools/qfcc/source/defspace.c
index 050d52a79..fc45e60df 100644
--- a/tools/qfcc/source/defspace.c
+++ b/tools/qfcc/source/defspace.c
@@ -99,6 +99,8 @@ defspace_alloc_loc (defspace_t *space, int size)
 	locref_t   *loc;
 	locref_t  **l = &space->free_locs;
 
+	if (size <= 0)
+		internal_error (0, "invalid number of words requested: %d", size);
 	while (*l && (*l)->size < size)
 		l = &(*l)->next;
 	if ((loc = *l)) {
@@ -116,9 +118,8 @@ defspace_alloc_loc (defspace_t *space, int size)
 	ofs = space->size;
 	space->size += size;
 	if (space->size > space->max_size) {
-		if (!space->grow)
+		if (!space->grow || !space->grow (space))
 			internal_error (0, "unable to allocate %d words", size);
-		space->grow (space);
 	}
 	return ofs;
 }
@@ -129,8 +130,8 @@ defspace_free_loc (defspace_t *space, int ofs, int size)
 	locref_t  **l;
 	locref_t   *loc;
 
-	if (!size)
-		internal_error (0, "defspace: freeing size 0 location");
+	if (size <= 0)
+		internal_error (0, "defspace: freeing size %d location", size);
 	if (ofs < 0 || ofs >= space->size || ofs + size > space->size)
 		internal_error (0, "defspace: freeing bogus location %d:%d",
 						ofs, size);
diff --git a/tools/qfcc/source/linker.c b/tools/qfcc/source/linker.c
index 7c1ad0102..309e8f256 100644
--- a/tools/qfcc/source/linker.c
+++ b/tools/qfcc/source/linker.c
@@ -536,7 +536,8 @@ add_data (int space, qfo_mspace_t *data)
 {
 	if (space < 0 || space >= qfo_num_spaces || !work_spaces[space])
 		linker_internal_error ("bad space for add_data (): %d", space);
-	defspace_add_data (*work_spaces[space], data->d.data, data->data_size);
+	if (data->data_size)
+		defspace_add_data (*work_spaces[space], data->d.data, data->data_size);
 	work->spaces[space].d.data = (*work_spaces[space])->data;
 	work->spaces[space].data_size = (*work_spaces[space])->size;
 }