From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glibc-bugs-return-4246-listarch-glibc-bugs=sources.redhat.com@sourceware.org>
Received: (qmail 5603 invoked by alias); 13 Mar 2006 04:43:04 -0000
Received: (qmail 5590 invoked by uid 48); 13 Mar 2006 04:43:00 -0000
Date: Mon, 13 Mar 2006 04:43:00 -0000
From: "umbrook0 at cs dot umanitoba dot ca" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sources.redhat.com
Message-ID: <20060313044300.2451.umbrook0@cs.umanitoba.ca>
Reply-To: sourceware-bugzilla@sourceware.org
Subject: [Bug libc/2451] New: dlopen can leak small amounts of memory if it fails
X-Bugzilla-Reason: CC
Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Subscribe: <mailto:glibc-bugs-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs@sourceware.org>
List-Help: <mailto:glibc-bugs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-owner@sourceware.org
X-SW-Source: 2006-03/txt/msg00063.txt.bz2
List-Id: <glibc-bugs.sourceware.org>

Valgrind reports that dlopen() leaks memory if it fails because the file is invalid.

To duplicate:
1. echo "Test" > not-a-lib.so
2. gcc -g test.c -ldl
3. valgrind --leak-check=full ./a.out

Result:
==5903== 15 bytes in 1 blocks are definitely lost in loss record 1 of 1
==5903==    at 0x1B909222: malloc (vg_replace_malloc.c:130)
==5903==    by 0x1B8EB8C7: expand_dynamic_string_token (in /lib/ld-2.3.5.so)
==5903==    by 0x1B8EC410: _dl_map_object (in /lib/ld-2.3.5.so)
==5903==    by 0x1B8F5273: dl_open_worker (in /lib/ld-2.3.5.so)
==5903==    by 0x1B8F1C6D: _dl_catch_error (in /lib/ld-2.3.5.so)
==5903==    by 0x1B8F59C8: _dl_open (in /lib/ld-2.3.5.so)
==5903==    by 0x5ABD41: dlopen_doit (in /lib/libdl-2.3.5.so)
==5903==    by 0x1B8F1C6D: _dl_catch_error (in /lib/ld-2.3.5.so)
==5903==    by 0x5AC3E2: _dlerror_run (in /lib/libdl-2.3.5.so)
==5903==    by 0x5ABDD1: dlopen@@GLIBC_2.1 (in /lib/libdl-2.3.5.so)
==5903==    by 0x8048422: main (test.c:7)

I found this problem on Fedora Core 4 (glibc 2.3.5).

The problem seems to be that it allocates variable called realname (using
expand_dynamic_string_token) in _dl_map_object, but may call _dl_signal_error
later in the function without freeing the variable.  It looks like a variable
called name_copy has the same problem.

If that is the problem, then, looking at the source code for glibc 2.4, it looks
like the problem is still there.

-- 
           Summary: dlopen can leak small amounts of memory if it fails
           Product: glibc
           Version: 2.3.5
            Status: NEW
          Severity: minor
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: umbrook0 at cs dot umanitoba dot ca
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=2451

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.