bugAVR Downloader/UploaDEr - Bugs: bug #42056, Current SVN version: double free...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #42056: Current SVN version: double free or corruption triggered at exit

Submitter:  None
Submitted:  Sat 05 Apr 2014 05:17:30 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  rliebscher Originator Name:  Rok Mandeljc
Originator Email:  -email is unavailable- Open/Closed:  Closed
Release:  None Programmer hardware: 
Device type: 

Mon 14 Apr 2014 09:47:13 PM UTC, comment #3: 

I applied the patch for svn revision 1298.

valgrind also shows no further problems for this part (still some findings regarding libusb usage.)

Rene Liebscher <rliebscher>
Group Member
Sun 13 Apr 2014 03:49:44 PM UTC, comment #2: 

The attached patch fixes the problem for me. It copies the usbpid list and its entries in pgm_dup().

Rainer Müller <raimue>
Sat 05 Apr 2014 05:44:58 PM UTC, comment #1: 

Thanks for the analysis!  I've seen the error before, but didn't
find the culprit so far.

Joerg Wunsch <joerg_wunsch>
Group administrator
Sat 05 Apr 2014 05:17:30 PM UTC, original submission:  

The current SVN version (r1295) of avrdude causes a double free or corruption at exit.

The problem seems to be introduced by the following commit: r1290: "pgm.c (pgm_free): Cleanup police: destroy the p->usbpid list when freeing the programmer struct." Reverting it fixes the issue.

However, the actual culprit is the code for duplication of programmer definitions, pgm_dup(). In line 165, information from source structure is copied to the new structure using memcpy(). pgm->id is then reinitialized, but pgm->usbpid is not, and remains a shallow copy. Therefore, when programmers are destroyed at exit, the usbpid entries in those duplicated programmer definitions end up being freed multiple times...

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rliebscher (Posted a comment)
  • -email is unavailable- added by raimue (Updated the item)
  • -email is unavailable- added by joerg_wunsch (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-04-14 rliebscher StatusConfirmed Fixed
        Assigned tojoerg_wunsch rliebscher
        Open/ClosedOpen Closed
    2014-04-13 raimue Attached File- Added 0001-bug-42056-double-free-or-corruption-triggered-at-exi.patch, #31164
    2014-04-05 joerg_wunsch StatusNone Confirmed
        Assigned toNone joerg_wunsch

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code