bugAVR C Runtime Library - Bugs: bug #11868, realloc doesn't work correctly on...


bug #11868: realloc doesn't work correctly on block at end of freelist when growing

Submitted by:  Peter Fuhrmann <tixiv>
Submitted on:  Sun 06 Feb 2005 01:21:37 AM UTC  
Category:  None Severity:  6 - Security
Priority:  9 - Immediate Item Group:  None
Status:  Fixed Assigned to:  Joerg Wunsch <joerg_wunsch>
Percent Complete:  0% Open/Closed:  Closed
Release:  None Fixed Release:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Tue 08 Feb 2005 08:37:17 PM UTC, comment #3: 

Thanks Peter, your analysis was completely correct, and I
applied your suggested fix (plus another one to catch attempts
of allocating beyond top of RAM).

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Mon 07 Feb 2005 11:44:45 PM UTC, comment #2: 

I sumitted a test file. I compile it with avr-gcc -mmcu=atmega128 -g realloc-test.c, but that shouldn't matter.

I think the Problem is, that you assume that cp is ptr+len in lines 132 and 133, which it isn't anymore, because it was changed in line 85.

Peter Fuhrmann <tixiv>
Mon 07 Feb 2005 10:05:06 PM UTC, comment #1: 

I tried to reproduce this, but failed so far.

If you've got a simple test case, please submit it.

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Sun 06 Feb 2005 01:21:37 AM UTC, original submission:  

when I alloc a blcok of memory, and then realloc it to a larger size, __brkval is not updated coorectly, so the next call to malloc overwrites the first memory block.
I think I found how to fix it, too. I added
cp = (char *)ptr + len;
at line 128 in realloc.c .
It works for me.

Peter Fuhrmann <tixiv>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #2525:  realloc-test.c added by tixiv (215B - application/octet-stream - Simple testcase that demonstrates this bug.)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty




Follow 6 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-02-08 joerg_wunsch StatusNone => Fixed
    Open/ClosedOpen => Closed
2005-02-07 tixiv Attached File- => Added realloc-test.c, #2168
2005-02-07 joerg_wunsch Severity3 - Normal => 6 - Security
    Priority5 - Normal => 9 - Immediate
    Assigned toNone => joerg_wunsch

Back to the top

Powered by Savane 3.5