bugAVR C Runtime Library - Bugs: bug #22567, malloc() can occasionally run into...

 
 

bug #22567: malloc() can occasionally run into an infinite loop

Submitted by:  Joerg Wunsch <joerg_wunsch>
Submitted on:  Wed 12 Mar 2008 09:54:19 AM UTC  
 
Category: LibrarySeverity: 4 - Important
Priority: 5 - NormalItem Group: None
Status: DuplicatePercent Complete: 0%
Assigned to: Joerg Wunsch <joerg_wunsch>Open/Closed: Closed
Release: AnyFixed Release: 1.6.6

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 29 Jun 2009 02:33:45 AM UTC, comment #3:

Yet another testcase,

I found out the first was because I freed a ptr twice. I think free should be robust to that but I don't know what ANSI-C specified in that case.

The first <<bugAcc()>> trigger the double free bug (infinite loop in malloc)

the second <<bugTim>> triggers the another infinite loop, quite possibly because of bug #25723. Yet, I still don't know the current cvs head includes the patch, I checked with the most recent branches (1.6-6) and haven't found significant differences with my version (v 1.5 2009/03/04)

(file #18338)

Maxime Lemonnier <maxlem>
Fri 26 Jun 2009 05:05:41 AM UTC, comment #2:

Hi,

I'm using the cvs head.

Is the fix supposed to be applied?

In case not, here's a test case to reproduce the bug (see attachment)

I'm using a mega128, default memory layout.

The addresses won't fit, these are from my real application.

Thank you for this precious library.

I'm willing to help further.

(file #18325)

Maxime Lemonnier <maxlem>
Wed 04 Mar 2009 09:41:51 PM UTC, comment #1:

After talking with one of the people whose reports made me
file this bug, I'm now reasonably convinced this has been the
same thing as bug #25723.

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Wed 12 Mar 2008 09:54:19 AM UTC, original submission:

I've seen two reports so far where malloc() eventually ran
into an infinite loop. This is caused by the freelist
becoming cyclically linked. So far, there's no test case
that would reliably reproduce this situation, but it should
be investigated what might cause that behaviour so it can
be fixed (and hopefully, a regression test could be written
as well for it).

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #18338:  main.cpp added by maxlem (4KiB - text/x-c++src - now with two test cases)
file #18325:  main.cpp added by maxlem (2KiB - text/x-c++src - TestCase to have malloc running in an infinite loop)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by maxlem (Updated the item)
  • -unavailable- added by arcanum (Updated the item)
  • -unavailable- added by joerg_wunsch (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 29 Jun 2009 02:33:45 AM UTCmaxlemAttached File-=>Added main.cpp, #18338
    Fri 26 Jun 2009 05:05:41 AM UTCmaxlemAttached File-=>Added main.cpp, #18325
    Wed 04 Mar 2009 09:41:51 PM UTCjoerg_wunschStatusNone=>Duplicate
      Assigned toNone=>joerg_wunsch
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>1.6.6
    Mon 11 Aug 2008 03:00:11 AM UTCarcanumReleaseNone=>Any
    Sun 16 Mar 2008 02:08:37 PM UTCarcanumCategoryNone=>Library

    Back to the top


    Powered by Savane 3.1-cleanup1