bugAVR C Runtime Library - Bugs: bug #27242, realloc: serious error when size...

 
 

bug #27242: realloc: serious error when size shrinks

Submitted by:  Stefan Ernst <sternst>
Submitted on:  Thu 13 Aug 2009 01:42:48 PM UTC  
Votes:  10  
 
Category: LibrarySeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: FixedPercent Complete: 0%
Assigned to: Joerg Wunsch <joerg_wunsch>Open/Closed: Closed
Release: 1.7.*Fixed Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 07 Jun 2010 02:50:12 PM UTC, comment #3:

Thanks, Aleksandar, for the fix and in particular for the
test case. Very much appreciated!

Joerg Wunsch <joerg_wunsch>
Project AdministratorIn charge of this item.
Mon 30 Nov 2009 06:36:02 PM UTC, comment #2:

I've attached a patch and a regression test for this bug. The patch passes my test cases and also the test cases of bug #25723 which caused this regression.

This was a very serious bug, I hope that all of it is fixed now.

Aleksandar Kanchev <kanchev>
Wed 26 Aug 2009 08:57:48 PM UTC, comment #1:

Joerg, you're the most familiar with malloc stuff. Assigning to you.

Eric Weddington <arcanum>
Project Administrator
Thu 13 Aug 2009 01:42:48 PM UTC, original submission:

When realloc is asked to lower the size of an allocated block, it calculates a wrong start address of the new free block. This results in an overlap, so the last two bytes of the reallocated block gets corrupted and the size information of the free block can be overwritten by the application.

Cause:

The comment and the "- sizeof(size_t)" are wrong.

Stefan Ernst <sternst>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #19159:  bug-27242.diff added by kanchev (3KiB - text/x-patch - regression test for bug 27242)
file #19158:  realloc-regression-25723.diff added by kanchev (2KiB - text/x-patch - fixes realloc() regression caused by fixing bug 25723)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by joerg_wunsch (Posted a comment)
  • -unavailable- added by kanchev (Updated the item)
  • -unavailable- added by arcanum (Posted a comment)
  • -unavailable- added by jsl (Voted in favor of this item)
  • -unavailable- added by sternst (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Jun 2010 02:50:12 PM UTCjoerg_wunschStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Wed 13 Jan 2010 05:06:39 AM UTCarcanumCategoryNone=>Library
    Mon 30 Nov 2009 06:25:35 PM UTCkanchevAttached File-=>Added bug-27242.diff, #19159
    Mon 30 Nov 2009 06:22:53 PM UTCkanchevAttached File-=>Added realloc-regression-25723.diff, #19158
    Wed 26 Aug 2009 08:57:48 PM UTCarcanumAssigned toNone=>joerg_wunsch
    Thu 20 Aug 2009 09:28:57 AM UTCjslCarbon-Copy-=>Added jsl

    Back to the top


    Powered by Savane 3.1-cleanup1