bugAVR C Runtime Library - Bugs: bug #27242, realloc: serious error when size...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #27242: realloc: serious error when size shrinks

Submitter:  Stefan Ernst <sternst>
Submitted:  Thu 13 Aug 2009 01:42:48 PM UTC
Votes: 10
 
Category:  Library Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Assigned to:  joerg_wunsch
Percent Complete:  0% Open/Closed:  Closed
Release:  1.7.* Fixed Release:  None

Mon 07 Jun 2010 02:50:12 PM UTC, comment #3: 

Thanks, Aleksandar, for the fix and in particular for the
test case.  Very much appreciated!

Joerg Wunsch <joerg_wunsch>
Group administrator
Mon 30 Nov 2009 06:36:02 PM UTC, comment #2: 

I've attached a patch and a regression test for this bug. The patch passes my test cases and also the test cases of bug #25723 which caused this regression.

This was a very serious bug, I hope that all of it is fixed now.

Aleksandar Kanchev <kanchev>
Wed 26 Aug 2009 08:57:48 PM UTC, comment #1: 

Joerg, you're the most familiar with malloc stuff. Assigning to you.

Eric Weddington <arcanum>
Group administrator
Thu 13 Aug 2009 01:42:48 PM UTC, original submission:  

When realloc is asked to lower the size of an allocated block, it calculates a wrong start address of the new free block. This results in an overlap, so the last two bytes of the reallocated block gets corrupted and the size information of the free block can be overwritten by the application.

Cause:


realloc(void *ptr, size_t len)
{
    ...
    cp = (char *)ptr + len; /* new next pointer */
    ...
    fp2 = (struct __freelist *)(cp - sizeof(size_t));


The comment and the "- sizeof(size_t)" are wrong.

Stefan Ernst <sternst>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #19159:  bug-27242.diff added by kanchev (3KiB - text/x-patch - regression test for bug 27242)
file #19158:  realloc-regression-25723.diff added by kanchev (2KiB - text/x-patch - fixes realloc() regression caused by fixing bug 25723)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by joerg_wunsch (Posted a comment)
  • -email is unavailable- added by kanchev (Updated the item)
  • -email is unavailable- added by arcanum (Posted a comment)
  • -email is unavailable- added by jsl (Voted in favor of this item)
  • -email is unavailable- added by sternst (Submitted the item)
  •  

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-07 joerg_wunsch StatusNone Fixed
        Open/ClosedOpen Closed
    2010-01-13 arcanum CategoryNone Library
    2009-11-30 kanchev Attached File- Added bug-27242.diff, #19159
    2009-11-30 kanchev Attached File- Added realloc-regression-25723.diff, #19158
    2009-08-26 arcanum Assigned toNone joerg_wunsch
    2009-08-20 jsl Carbon-Copy- Added jsl

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code