1 files changed, 76 insertions, 0 deletions
diff --git a/debian/patches/0003-include-detect-use-after-free-errors-using-the-refer.patch b/debian/patches/0003-include-detect-use-after-free-errors-using-the-refer.patch
new file mode 100644
index 00000000..1690e1fd
--- /dev/null
+++ b/debian/patches/0003-include-detect-use-after-free-errors-using-the-refer.patch
@@ -0,0 +1,76 @@
+From 6a36e42db8d32e66a1057d894a8d9c6da77f07a7 Mon Sep 17 00:00:00 2001
+From: Justus Winter <4winter@informatik.uni-hamburg.de>
+Date: Fri, 20 Jun 2014 14:27:59 +0200
+Subject: [PATCH 03/10] include: detect use-after-free errors using the
+ reference counts
+
+* include/refcount.h (refcount_init): There must be at least one
+reference at initialization time.
+(refcounts_init): Likewise.
+(refcount_ref): Detect use-after-free errors.
+(refcounts_ref): Likewise.
+(refcounts_ref_weak): Likewise.
+---
+ include/refcount.h | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/include/refcount.h b/include/refcount.h
+index 785b052..1efe865 100644
+--- a/include/refcount.h
++++ b/include/refcount.h
+@@ -31,10 +31,11 @@
+ /* An opaque type.  You must not access these values directly.  */
+ typedef unsigned int refcount_t;
+ 
+-/* Initialize REF with REFERENCES.  */
++/* Initialize REF with REFERENCES.  REFERENCES must not be zero.  */
+ static inline void
+ refcount_init (refcount_t *ref, unsigned int references)
+ {
++  assert (references > 0 || !"references must not be zero!");
+   *ref = references;
+ }
+ 
+@@ -47,6 +48,7 @@ refcount_ref (refcount_t *ref)
+   unsigned int r;
+   r = __atomic_add_fetch (ref, 1, __ATOMIC_RELAXED);
+   assert (r != UINT_MAX || !"refcount overflowed!");
++  assert (r > 1 || !"refcount detected use after free!");
+   return r;
+ }
+ 
+@@ -101,10 +103,12 @@ union _references {
+   uint64_t value;
+ };
+ 
+-/* Initialize REF with HARD and WEAK references.  */
++/* Initialize REF with HARD and WEAK references.  HARD and WEAK must
++   not both be zero.  */
+ static inline void
+ refcounts_init (refcounts_t *ref, uint32_t hard, uint32_t weak)
+ {
++  assert ((hard != 0 || weak != 0) || !"references must not both be zero!");
+   ref->references = (struct references) { .hard = hard, .weak = weak };
+ }
+ 
+@@ -119,6 +123,8 @@ refcounts_ref (refcounts_t *ref, struct references *result)
+   union _references r;
+   r.value = __atomic_add_fetch (&ref->value, op.value, __ATOMIC_RELAXED);
+   assert (r.references.hard != UINT32_MAX || !"refcount overflowed!");
++  assert (! (r.references.hard == 1 && r.references.weak == 0)
++          || !"refcount detected use after free!");
+   if (result)
+     *result = r.references;
+ }
+@@ -208,6 +214,8 @@ refcounts_ref_weak (refcounts_t *ref, struct references *result)
+   union _references r;
+   r.value = __atomic_add_fetch (&ref->value, op.value, __ATOMIC_RELAXED);
+   assert (r.references.weak != UINT32_MAX || !"refcount overflowed!");
++  assert (! (r.references.hard == 0 && r.references.weak == 1)
++          || !"refcount detected use after free!");
+   if (result)
+     *result = r.references;
+ }
+-- 
+2.0.0
+