Back to index

glibc  2.9
Defines | Functions
mallocbug.c File Reference
#include <malloc.h>
#include <stdio.h>
#include <string.h>

Go to the source code of this file.


#define size_t   unsigned int


int main (int argc, char *argv[])

Define Documentation

#define size_t   unsigned int

Definition at line 6 of file mallocbug.c.

Function Documentation

int main ( int  argc,
char *  argv[] 

Definition at line 9 of file mallocbug.c.

  char *dummy0;
  char *dummy1;
  char *fill_info_table1;
  char *over_top;
  size_t over_top_size = 0x3000;
  char *over_top_dup;
  size_t over_top_dup_size = 0x7000;
  char *x;
  size_t i;

  /* Here's what memory is supposed to look like (hex):
        size  contents
        3000  original_info_table, later fill_info_table1
      3fa000  dummy0
      3fa000  dummy1
        6000  info_table_2
       3000  over_top

  /* mem: original_info_table */
  dummy0 = malloc (0x3fa000);
  /* mem: original_info_table, dummy0 */
  dummy1 = malloc (0x3fa000);
  /* mem: free, dummy0, dummy1, info_table_2 */
  fill_info_table1 = malloc (0x3000);
  /* mem: fill_info_table1, dummy0, dummy1, info_table_2 */

  x = malloc (0x1000);
  free (x);
  /* mem: fill_info_table1, dummy0, dummy1, info_table_2, freexx */

  /* This is what loses; info_table_2 and freexx get combined unbeknownst
     to mmalloc, and mmalloc puts over_top in a section of memory which
     is on the free list as part of another block (where info_table_2 had
     been).  */
  over_top = malloc (over_top_size);
  over_top_dup = malloc (over_top_dup_size);
  memset (over_top, 0, over_top_size);
  memset (over_top_dup, 1, over_top_dup_size);

  for (i = 0; i < over_top_size; ++i)
    if (over_top[i] != 0)
       printf ("FAIL: malloc expands info table\n");
       return 0;

  for (i = 0; i < over_top_dup_size; ++i)
    if (over_top_dup[i] != 1)
       printf ("FAIL: malloc expands info table\n");
       return 0;

  printf ("PASS: malloc expands info table\n");
  return 0;

Here is the call graph for this function: