get glibc free method call stack

[赵爱南]

hi 

Now I by fprintf in malloc.c， below:




I add the below content in __libc_malloc mathod:

#if USE_TCACHE

.................................

if (tc_idx < mp_.tcache_bins

   && tcache

   && tcache->counts[tc_idx] > 0)

{

  victim = tcache_get(tc_idx);

  fprintf(stderr, "addres %lx get from tcache_get tbytes is %d, tc_idx is %d \n", victim , tbytes, tc_idx);

  return tag_new_usable(victim);

}

................

#endif







and then add the below contests in _int_free:




_int_free (mstate av, mchunkptr p, int have_lock)

{

      ...........................

    size = chunksize (p);

   fprintf(stderr, "free chunk address is %lx, size is %d\n", p, size);

  .......................

}







and then I got the log:

free chunk address is 40f83db74d50  size is 672                                                 -------------------------------> first free

address 40f83db74d60 get from tcache_get btytes is 672, tc_idx is 40               --------------------------------> malloc

free chunk address is 40f83db74d50 size is 978527096                                      -------------------------------->second free

free(): invalid size




why the second free the [size = chunksize(p)  ]  is not 672  and there had a error, thanks.  And I think the addree[malloc] get from the tcache and the mchunk_size which in struct malloc_chunk did not have the value.




--------------------------------------------------------------------------------------------------------------------------------------------------------
Hello:


Now there is a error in glibc2.34:


free():invalid size


Through debugging, it was found that when libc_malloc is allocated from tcache_get, but the size size is negative, causing an error in determining the size when free. May I ask if there is always a value for size when allocating from tcache.








thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20241024/399421f9/attachment.htm>