[Bug libc/10776] New: With M_MMAP_MAX=0 free() causes undefined behaviour.

[Bug libc/10776] New: With M_MMAP_MAX=0 free() causes undefined behaviour.

[Christian dot Meier at informatik dot stud dot uni-erlangen dot de]

Calling the following at the beginning of main causes an application (with many
allocations) to behave undefined.

if (mlockall(MCL_CRRENT|MCL_FUTURE))
  return 1;

mallopt(M_TRIM_THRESHOLD, -1);
mallopt(M_MMAP_MAX, 0);
int * buffer = (int*) malloc(10*1024*1024);

if (!buffer)
  return 1;

for (int i = 0; i < 10*1024*1024/sizeof(int); ++i) {
  buffer[i] = 42;
}
free(buffer);

However, commenting out either free(buffer); or mallopt(M_MAP_MAX, 0); causes
the application to behave as expected.

-- 
           Summary: With M_MMAP_MAX=0 free() causes undefined behaviour.
           Product: glibc
           Version: 2.10
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: Christian dot Meier at informatik dot stud dot uni-
                    erlangen dot de
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=10776

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10776] With M_MMAP_MAX=0 free() causes undefined behaviour.

[Christian dot Meier at informatik dot stud dot uni-erlangen dot de]

------- Additional Comments From Christian dot Meier at informatik dot stud dot uni-erlangen dot de  2009-10-14 13:10 -------
Commenting out the buffer write loop also causes the application to behave as
expected.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10776

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10776] With M_MMAP_MAX=0 free() causes undefined behaviour.

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-10-29 20:28 -------
There isn't enough information in the report.  Provide a small, self-contained
test case.  Otherwise debug your program and point to the problem.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING


http://sourceware.org/bugzilla/show_bug.cgi?id=10776

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/10776] With M_MMAP_MAX=0 free() causes undefined behaviour.

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=10776

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/10776] With M_MMAP_MAX=0 free() causes undefined behaviour.

[pasky at suse dot cz]

http://sourceware.org/bugzilla/show_bug.cgi?id=10776

Petr Baudis <pasky at suse dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
                 CC|                            |pasky at suse dot cz
         Resolution|                            |WORKSFORME

--- Comment #3 from Petr Baudis <pasky at suse dot cz> 2011-02-04 01:32:05 UTC ---
Unfortunately, no self-contained testcase has been provided.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.