bugAVR C Runtime Library - Bugs: bug #2143, malloc() routines chunk smaller...

 
 

bug #2143: malloc() routines chunk smaller than requested

Submitted by:  None
Submitted on:  Mon 06 Jan 2003 03:18:55 PM UTC  
 
Category: LibrarySeverity: 4 - Important
Priority: 5 - NormalItem Group: None
Status: FixedPercent Complete: 0%
Assigned to: Joerg Wunsch <joerg_wunsch>Originator Email: -unavailable-
Open/Closed: ClosedRelease: None
Fixed Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 15 Feb 2004 08:39:43 PM UTC, comment #4:

This problem has finally been fixed in rev 1.8 of malloc.c.
Thanks for bringing this serious bug to our attention.

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Thu 10 Jul 2003 02:09:41 PM UTC, comment #3:

malloc fails to detect that insufficient memory
is available if you allocate a block with length
larger than (unsigned)(0xffff) - brkval due to overflow
in the data types used.

doing it the quick way:
malloc()
{
unsigned long reqend;

/* ..... */

line 201:
reqend = (unsigned long)(brkval) + (unsigned long)(len) + (unsigned long)(sizeof(size_t));

if ( reqend < (unsigned long)(cp) ) {
/* ... */
}

OR you could detect that brkval+len < len if you do want to keep
it somewhat independent of size_t being 16 bits (which doesn't
seem to make sense on the AVR?).

Hope this helps

Regards
Titus

Anonymous
Tue 25 Feb 2003 11:19:01 AM UTC, comment #2:

creating a memmory heap malloc function writes some bytes of header information for handling heap size

Anonymous
Mon 06 Jan 2003 10:02:42 PM UTC, comment #1:

malloc() is my baby.

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Mon 06 Jan 2003 03:18:55 PM UTC, original submission:

I believe I've found in bug that exists in the malloc() implementation in the
snapshots from 17dec2002 and 04nov2002.

Here's (basically) the code I'm running:

char *ptrs[32];
__malloc_heap_start = 0x8000;
__malloc_heap_end = 0xFFFF;
for (j = 0; j < 32; j++) {
ptrs[j] = (char *)malloc(1024);
/* output j and ptrs[j] to serial port */
}

I would expect the last malloc() to return NULL, since there's not 1024 bytes
left in the heap. Instead, I get the following output:

  1. = 00008002

1 = 00008404
2 = 00008806
-cut-
29 = 0000f43c
30 = 0000f83e
31 = 0000fc40

The last malloc() returns a chunk of memory that is only 959 bytes before the
end of the heap!

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sun 15 Feb 2004 08:39:43 PM UTCjoerg_wunschStatusNone=>Fixed
  Open/ClosedOpen=>Closed
Thu 12 Feb 2004 08:26:38 PM UTCjoerg_wunschSeverity3 - Normal=>4 - Important
Mon 06 Jan 2003 10:02:42 PM UTCjoerg_wunschAssigned toNone=>NA

Back to the top


Powered by Savane 3.1-cleanup1