Message-ID: <7d97575b-24ac-4d55-be14-266ade57b992@gmail.com>
Date: Tue, 1 Oct 2024 22:57:15 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: djgpp AT delorie DOT com
From: "J.W. Jagersma (jwjagersma AT gmail DOT com) [via djgpp AT delorie DOT com]" <djgpp AT delorie DOT com>
Subject: malloc clobbers sbrk'd memory
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Reply-To: djgpp AT delorie DOT com

I believe I found a bug where malloc sporadically writes past the end
of a memory chunk.

I ran into this while working on mcount, which allocates the histogram
and call graph via sbrk.  When my test program was invoked with some
specific number of arguments, the first histogram entry was clobbered,
which in gprof appeared as if the program had spent a lot of time in
'start'.  Turns out: the clobber value is the same as the special 'NONE'
pointer used in nmalloc.c.

What I believe is happening: the minimum chunk size created by
__nmalloc_split is DATAOFFSET (which is sizeof(memblock)-4; does *not*
include prevfree).  But when the high half is then passed to
mv2freelist, it writes prevfree=NONE, which is now past the end of the
chunk.

Solution is probably to define MINSAVE as (ALIGN + sizeof (memblock)),
regardless of SAVEMEMORY tricks.  It might be worth adding another 16
bytes or so, since minimum-size chunks are useless and only add clutter
to the freelist.

See test case below.  Compile with -O0 and invoke with some number of
arguments.  On my machine the bug triggers with 21 single-char args,
like so:

C:\>test.exe x x x x x x x x x x x x x x x x x x x x x

But the exact number may be dependent on environment size or other
factors.

---
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

int main ()
{
  free (malloc (100000));
  int *p = (int *)sbrk (sizeof (int));
  *p = 0;

  for (unsigned i = 0; i != 100000; ++i)
  {
    void *q = malloc (1);

    if (*p != 0)
    {
      printf ("BAD: *p=%i after %u mallocs!\n", *p, i + 1);
      return 1;
    }

    if (q > (void *)p)
    {
      printf ("passed p after %u mallocs\n", i + 1);
      break;
    }
  }

  printf ("OK\n");
  return 0;
}