bugAVR C Runtime Library - Bugs: bug #2143, malloc() routines chunk smaller...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #2143: malloc() routines chunk smaller than requested

Submitter:  None
Submitted:  Mon 06 Jan 2003 03:18:55 PM UTC
   
 
Category:  Library Severity:  4 - Important
Priority:  5 - Normal Item Group:  None
Status:  Fixed Assigned to:  joerg_wunsch
Percent Complete:  0% Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  None
Fixed Release:  None

Discussion

Sun 15 Feb 2004 08:39:43 PM UTC, comment #4: 

This problem has finally been fixed in rev 1.8 of malloc.c.
Thanks for bringing this serious bug to our attention.

Joerg Wunsch <joerg_wunsch>
Group administrator
Thu 10 Jul 2003 02:09:41 PM UTC, comment #3: 

malloc fails to detect that insufficient memory
is available if you allocate a block with length
larger than (unsigned)(0xffff) - brkval due to overflow
in the data types used.

doing it the quick way:
malloc()
{
unsigned long reqend;

/* ..... */

line 201:
reqend = (unsigned long)(brkval) + (unsigned long)(len) + (unsigned long)(sizeof(size_t));

if ( reqend < (unsigned long)(cp) ) {
/* ... */
}

OR you could detect that brkval+len < len if you do want to keep
it somewhat independent of size_t being 16 bits (which doesn't
seem to make sense on the AVR?).

Hope this helps

Regards
Titus


Anonymous
Tue 25 Feb 2003 11:19:01 AM UTC, comment #2: 

creating a memmory heap malloc function writes some bytes of header information for handling heap size

Anonymous
Mon 06 Jan 2003 10:02:42 PM UTC, comment #1: 

malloc() is my baby.

Joerg Wunsch <joerg_wunsch>
Group administrator
Mon 06 Jan 2003 03:18:55 PM UTC, original submission:  


I believe I've found in bug that exists in the malloc() implementation in the
snapshots from 17dec2002 and 04nov2002.

Here's (basically) the code I'm running:

        char *ptrs[32];
        __malloc_heap_start = 0x8000;
        __malloc_heap_end = 0xFFFF;
        for (j = 0; j < 32; j++) {
                ptrs[j] = (char *)malloc(1024);
                /* output j and ptrs[j] to serial port */
        }

I would expect the last malloc() to return NULL, since there's not 1024 bytes
left in the heap.  Instead, I get the following output:

  1. = 00008002

1 = 00008404
2 = 00008806
-cut-
29 = 0000f43c
30 = 0000f83e
31 = 0000fc40

The last malloc() returns a chunk of memory that is only 959 bytes before the
end of the heap!


Anonymous

 

Attached Files

This item currently has no attached files.

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

 

History

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-02-15 joerg_wunsch StatusNone Fixed
    Open/ClosedOpen Closed
2004-02-12 joerg_wunsch Severity3 - Normal 4 - Important
2003-01-06 joerg_wunsch Assigned toNone NA

Back to the top

Powered by Savane 3.16-1e6f.
Corresponding source code