Re: Heap corruption [the thread formerly known as substitution]

[Peter Stephenson <p.stephenson@samsung.com>]

On Thu, 1 Oct 2015 15:28:23 +0100
Peter Stephenson <p.stephenson@samsung.com> wrote:
> That "alloc" is what gdb, valgrind and the OS itself agree is out of
> bounds.  Sure enough, the sums say the heap finishes at 0x2b98ac555000,
> heap + 16384 or equivalently arena + 16344.  Likely this is the last
> heap allocated.

More news: Penny Finally Drops.

Yes, the pointer isn't usable --- but the length is zero so it can't be
dereferenced anyway.  A pointer one off the end of a valid range is
valid as long it's not dereferenced, so only the pattern code needs
fixing.  Was broken regardless of heap storage, that just showed it up.

pws

diff --git a/Src/pattern.c b/Src/pattern.c
index 68a3409..53bbd14 100644
--- a/Src/pattern.c
+++ b/Src/pattern.c
@@ -2224,8 +2224,10 @@ pattryrefs(Patprog prog, char *string, int stringlen, int unmetalenin,
 	maxnpos = *nump;
 	*nump = 0;
     }
-    /* inherited from domatch, but why, exactly? */
-    if (*string == Nularg) {
+    /*
+     * Special signalling of empty tokinised string.
+     */
+    if ((!patstralloc || stringlen > 0) && *string == Nularg) {
 	string++;
 	if (unmetalenin > 0)
 	    unmetalenin--;
@@ -2233,8 +2235,10 @@ pattryrefs(Patprog prog, char *string, int stringlen, int unmetalenin,
 	    stringlen--;
     }
 
-    if (stringlen < 0)
+    if (stringlen < 0) {
+	DPUTS(patstralloc != NULL, "length needed with patstralloc");
 	stringlen = strlen(string);
+    }
     origlen = stringlen;
 
     if (patstralloc) {