bugAVR C Runtime Library - Bugs: bug #11868, realloc doesn't work correctly on...

 
 

bug #11868: realloc doesn't work correctly on block at end of freelist when growing

Submitted by:  Peter Fuhrmann <tixiv>
Submitted on:  Sun 06 Feb 2005 01:21:37 AM UTC  
 
Category: NoneSeverity: 6 - Security
Priority: 9 - ImmediateItem Group: None
Status: FixedPercent Complete: 0%
Assigned to: Joerg Wunsch <joerg_wunsch>Open/Closed: Closed
Release: NoneFixed Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 08 Feb 2005 08:37:17 PM UTC, comment #3:

Thanks Peter, your analysis was completely correct, and I
applied your suggested fix (plus another one to catch attempts
of allocating beyond top of RAM).

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Mon 07 Feb 2005 11:44:45 PM UTC, comment #2:

I sumitted a test file. I compile it with avr-gcc -mmcu=atmega128 -g realloc-test.c, but that shouldn't matter.

I think the Problem is, that you assume that cp is ptr+len in lines 132 and 133, which it isn't anymore, because it was changed in line 85.

Peter Fuhrmann <tixiv>
Mon 07 Feb 2005 10:05:06 PM UTC, comment #1:

I tried to reproduce this, but failed so far.

If you've got a simple test case, please submit it.

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Sun 06 Feb 2005 01:21:37 AM UTC, original submission:

when I alloc a blcok of memory, and then realloc it to a larger size, __brkval is not updated coorectly, so the next call to malloc overwrites the first memory block.
I think I found how to fix it, too. I added
cp = (char *)ptr + len;
at line 128 in realloc.c .
It works for me.

Peter Fuhrmann <tixiv>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #2525:  realloc-test.c added by tixiv (215B - application/octet-stream - Simple testcase that demonstrates this bug.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 6 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 08 Feb 2005 08:37:17 PM UTCjoerg_wunschStatusNone=>Fixed
  Open/ClosedOpen=>Closed
Mon 07 Feb 2005 11:39:00 PM UTCtixivAttached File-=>Added realloc-test.c, #2168
Mon 07 Feb 2005 09:01:26 PM UTCjoerg_wunschSeverity3 - Normal=>6 - Security
  Priority5 - Normal=>9 - Immediate
  Assigned toNone=>joerg_wunsch

Back to the top


Powered by Savane 3.1-cleanup1