Bug 64991
| Summary: | malloc(3) crashes with some large parameters | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Jinmei Tatuya <jinmei> |
| Component: | bin | Assignee: | Poul-Henning Kamp <phk> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | 4.9-RELEASE | ||
| Hardware: | Any | ||
| OS: | Any | ||
Responsible Changed From-To: freebsd-bugs->phk Assign to malloc author Note that 5-CURRENT is not affected. 4-STABLE is affected. -- Sumikawa State Changed From-To: open->suspended I'm not active in releng_4 any more, sorry. State Changed From-To: suspended->closed OK, I'm out of date: originator says it was fixed in 1.49.2.5. |
malloc(3) dumps core for large size parameters around 0xffff0000. Fix: I don't have one. How-To-Repeat: Compile the following code and execute it. Then something similar to the following should happen: % ./foo malloc: Cannot allocate memory zsh: 2153 segmentation fault (core dumped) ./foo #include <sys/types.h> #include <sys/param.h> #include <stdio.h> #include <stdlib.h> main() { char *p; p = (char *)malloc(0x8fff0000); if (p == NULL) perror("malloc"); else free(p); p = (char *)malloc(0xffff0000); if (p == NULL) perror("malloc"); exit(0); }