AVR C Runtime Library - Bugs: bug #27242, realloc: serious error when size...
You are not allowed to post comments on this tracker with your current authentication level.
bug #27242: realloc: serious error when size shrinks
Submitter: | Stefan Ernst <sternst> | ||
Submitted: | Thu 13 Aug 2009 01:42:48 PM UTC | ||
Votes: | 10 | ||
Category: | Library | Severity: | 3 - Normal |
Priority: | 5 - Normal | Item Group: | None |
Status: | Fixed | Assigned to: | joerg_wunsch |
Percent Complete: | 0% | Open/Closed: | Closed |
Release: | 1.7.* | Fixed Release: | None |
Mon 07 Jun 2010 02:50:12 PM UTC, comment #3: |
Joerg Wunsch <joerg_wunsch> |
Mon 30 Nov 2009 06:36:02 PM UTC, comment #2: I've attached a patch and a regression test for this bug. The patch passes my test cases and also the test cases of bug #25723 which caused this regression.
|
Aleksandar Kanchev <kanchev> |
Wed 26 Aug 2009 08:57:48 PM UTC, comment #1: Joerg, you're the most familiar with malloc stuff. Assigning to you. |
Eric Weddington <arcanum> |
Thu 13 Aug 2009 01:42:48 PM UTC, original submission:
When realloc is asked to lower the size of an allocated block, it calculates a wrong start address of the new free block. This results in an overlap, so the last two bytes of the reallocated block gets corrupted and the size information of the free block can be overwritten by the application.
|
Stefan Ernst <sternst> |
Depends on the following items: None found
Items that depend on this one: None found
Follow 7 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2010-06-07 | joerg_wunsch | Status | None | Fixed | |
Open/Closed | Open | Closed | |||
2010-01-13 | arcanum | Category | None | Library | |
2009-11-30 | kanchev | Attached File | - | Added bug-27242.diff, #19159 | |
2009-11-30 | kanchev | Attached File | - | Added realloc-regression-25723.diff, #19158 | |
2009-08-26 | arcanum | Assigned to | None | joerg_wunsch | |
2009-08-20 | jsl | Carbon-Copy | - | Added jsl |
Powered by Savane 3.13-caa5.
Corresponding source code
Thanks, Aleksandar, for the fix and in particular for the
test case. Very much appreciated!