bugAVR C Runtime Library - Bugs: bug #2143, malloc() routines chunk smaller...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #2143: malloc() routines chunk smaller than requested

Submitter:  None
Submitted:  Mon 06 Jan 2003 03:18:55 PM UTC
   
 
Category:  Library Severity:  4 - Important
Priority:  5 - Normal Item Group:  None
Status:  Fixed Assigned to:  joerg_wunsch
Percent Complete:  0% Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  None
Fixed Release:  None

Sun 15 Feb 2004 08:39:43 PM UTC, comment #4: 

This problem has finally been fixed in rev 1.8 of malloc.c.
Thanks for bringing this serious bug to our attention.

Joerg Wunsch <joerg_wunsch>
Group administrator
Thu 10 Jul 2003 02:09:41 PM UTC, comment #3: 

malloc fails to detect that insufficient memory
is available if you allocate a block with length
larger than (unsigned)(0xffff) - brkval due to overflow
in the data types used.

doing it the quick way:
malloc()
{
unsigned long reqend;

/* ..... */

line 201:
reqend = (unsigned long)(brkval) + (unsigned long)(len) + (unsigned long)(sizeof(size_t));

if ( reqend < (unsigned long)(cp) ) {
/* ... */
}

OR you could detect that brkval+len < len if you do want to keep
it somewhat independent of size_t being 16 bits (which doesn't
seem to make sense on the AVR?).

Hope this helps

Regards
Titus


Anonymous
Tue 25 Feb 2003 11:19:01 AM UTC, comment #2: 

creating a memmory heap malloc function writes some bytes of header information for handling heap size

Anonymous
Mon 06 Jan 2003 10:02:42 PM UTC, comment #1: 

malloc() is my baby.

Joerg Wunsch <joerg_wunsch>
Group administrator
Mon 06 Jan 2003 03:18:55 PM UTC, original submission:  


I believe I've found in bug that exists in the malloc() implementation in the
snapshots from 17dec2002 and 04nov2002.

Here's (basically) the code I'm running:

        char *ptrs[32];
        __malloc_heap_start = 0x8000;
        __malloc_heap_end = 0xFFFF;
        for (j = 0; j < 32; j++) {
                ptrs[j] = (char *)malloc(1024);
                /* output j and ptrs[j] to serial port */
        }

I would expect the last malloc() to return NULL, since there's not 1024 bytes
left in the heap.  Instead, I get the following output:

  1. = 00008002

1 = 00008404
2 = 00008806
-cut-
29 = 0000f43c
30 = 0000f83e
31 = 0000fc40

The last malloc() returns a chunk of memory that is only 959 bytes before the
end of the heap!


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-02-15 joerg_wunsch StatusNone Fixed
    Open/ClosedOpen Closed
2004-02-12 joerg_wunsch Severity3 - Normal 4 - Important
2003-01-06 joerg_wunsch Assigned toNone None

Back to the top

Powered by Savane 3.13-758e.
Corresponding source code