This is the mail archive of the libc-hacker@sources.redhat.com mailing list for the glibc project.

Note that libc-hacker is a closed list. You may look at the archives of this list, but subscription and posting are not open.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

libio is seriously broken

I got

#0  fprintf (stream=0x4014fc60, 
    format=0x40147f82 "free(): invalid pointer %p!\n") at fprintf.c:31
#1  0x400a90f4 in free_check (mem=0x4001d000, caller=0x400a2e2b)
    at malloc.c:4542
#2  0x400a6e1d in __libc_free (mem=0x4001d000) at malloc.c:3012
#3  0x400a2e2b in __underflow (fp=0x80fbee0) at genops.c:167
#4  0x400a24a5 in _IO_file_xsgetn (fp=0x80fbee0, data=0xbffff3e0, n=40)
    at fileops.c:970
#5  0x400a37f2 in _IO_sgetn (fp=0x80fbee0, data=0xbffff3e0, n=40)
    at genops.c:448
#6  0x40098847 in _IO_fread (buf=0xbffff3e0, size=1, count=40, fp=0x80fbee0)
    at iofread.c:42
#7  0x80648ce in bfd_read (ptr=0xbffff3e0, size=40, nitems=1, abfd=0x81abd78)
The problem is

	free (fp->_IO_save_base);

in _IO_free_backup_area () in genops.c. Please keep in mind that libio
uses ALLOC_BUF for main buffer allocation, which calls mmap. But
malloc/free is used for _IO_save_base. When we switch between backup
and main buffer, we have to be very careful. Otherwise, we will be
screwed. I will see what I can do.

-- 
H.J. Lu (hjl@gnu.org)
Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]