From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4418 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: NULL deref SEGV in malloc.c:unbin() Date: Fri, 27 Dec 2013 17:13:45 -0500 Message-ID: <20131227221345.GG24286@brightrain.aerifal.cx> References: <20131227190544.GF24286@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1388182433 17260 80.91.229.3 (27 Dec 2013 22:13:53 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 27 Dec 2013 22:13:53 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-4422-gllmg-musl=m.gmane.org@lists.openwall.com Fri Dec 27 23:14:00 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1VwffK-0005Cp-SX for gllmg-musl@plane.gmane.org; Fri, 27 Dec 2013 23:13:59 +0100 Original-Received: (qmail 11835 invoked by uid 550); 27 Dec 2013 22:13:58 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 11824 invoked from network); 27 Dec 2013 22:13:57 -0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:4418 Archived-At: On Fri, Dec 27, 2013 at 07:44:23PM +0000, David Wuertele wrote: > Rich Felker aerifal.cx> writes: > > On Fri, Dec 27, 2013 at 06:35:00PM +0000, David Wuertele wrote: > > > I wonder if anyone has hit this before? In unbin(), c->next->prev is set, > > > but c->next is NULL. It happens repeatedly, and here's what gdb says: > > > > It's almost surely a case of memory corruption by the calling program, > > most likely using memory after it's already been freed. > > Hmm, my program calls malloc() once and never calls free(). And this crash happens on the very first call to malloc? Or did you mean it only called it once successfully? > Oh, I guess it does call free indirectly when it uses closedir() and fclose(). > I will try to use gdb/watch to catch someone red-handed. It's also possible you write past the end of the buffer obtained by malloc. Rich