Message-ID: <38FC4A45.54C24CDF@bigfoot.com>
From: "J.P. Morris" <doug-15 AT bigfoot DOT com>
Organization: Aircraft Liberation Front
X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14-15mdk i586)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.os.msdos.djgpp
Subject: Re: dead beef
References: <Pine DOT SUN DOT 3 DOT 91 DOT 1000418113426 DOT 28255U-100000 AT is>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 49
Date: Tue, 18 Apr 2000 12:43:01 +0100
NNTP-Posting-Host: 212.56.119.112
X-Complaints-To: abuse AT plus DOT net DOT uk
X-Trace: stones 956057994 212.56.119.112 (Tue, 18 Apr 2000 12:39:54 BST)
NNTP-Posting-Date: Tue, 18 Apr 2000 12:39:54 BST
To: djgpp AT delorie DOT com
DJ-Gateway: from newsgroup comp.os.msdos.djgpp
Reply-To: djgpp AT delorie DOT com

Eli Zaretskii wrote:
> 
> On Mon, 17 Apr 2000, J.P. Morris wrote:
> 
> > Under Linux, the program runs correctly for an indefinite period.
> > Under DJGPP, however, it crashes between 9:00 and 11:00 game time,
> > i.e. about 180-300 cycles of the game loop.
> 
> Linux (and most or all Unix systems in general) zero out sbrk'ed
> memory allocated for the process.  DJGPP's sbrk doesn't do that by
> default (for performance reasons), so these crashes might mean you are
> using uninitialized memory.
> 
> I suggest using the _CRT0_FLAG_FILL_SBRK_MEMORY (not
> _CRT0_FLAG_FILL_DEADBEEF!) to see whether this is your problem.
> 

At one stage I tried this, but it crashed by NULL dereference
instead.

> 
> > I would guess that the problem must be one of these:
> >
> > 1. A memory overrun of statically-allocated data (is there a tool to detect
> > this?)
> 
> I don't understand what overrun do you have in mind, and neither do I
> think such things can happen.  Please elaborate.

Suppose I did this?

char array[128];

for(ctr=0;ctr<65535;ctr++)
  array[ctr]=0;

Fortify (and presumably MSS et al) put sentry-blocks around memory that
is allocated dynamically, using a wrapper around malloc() and calloc(),
but since malloc and free aren't used for local arrays or other objects,
it wouldn't detect that unless it was a big enough overrun to reach
a dynamically-allocated object.


-- 
JP Morris - aka DOUG the Eagle (Dragon) -=UDIC=-  DOUG-15 AT bigfoot DOT com
Fun things to do with the Ultima games            (http://ithe.cjb.net)
Developing a U6/U7 clone                          (http://fly.to/ire)
d+++ e+ N+ T++ Om U1234!56!7'!S'!8!9!KA u++ uC+++ uF+++ uG---- uLB----
uA--- nC+ nR---- nH+++ nP++ nI nPT nS nT wM- wC- y a(YEAR - 1976)