Thread: heap corruption + mcheck resulted core + identifying the exact cause

Hi all,


I facing an issue with heap corruption.
In my code i am trying to extract line by line form one of the file using getline. After this i do some parsing and then free the line buffer once done.

Here at free i it generates the core . Below is the core trace.

Code:

#0  0x0000003539435069 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x0000003539438168 in __GI_abort () at abort.c:89
#2  0x000000353946e544 in __libc_message (do_abort=<optimized out>, fmt=<optimized out>) at ../sysdeps/posix/libc_fatal.c:175
#3  0x000000353946e56e in __GI___libc_fatal (message=<optimized out>) at ../sysdeps/posix/libc_fatal.c:186
#4  0x000000353947e4f5 in mabort (status=<optimized out>) at mcheck.c:363
#5  0x000000353947e5a8 in checkhdr (hdr=hdr@entry=0x6214d0) at mcheck.c:114
#6  0x000000353947e9b9 in checkhdr (hdr=0x6214d0) at mcheck.c:186
#7  freehook (ptr=0x621500, caller=0x7f119dcdf3c6 <target_get_config_value+454>) at mcheck.c:187
#8  0x00007f119dcdf3c6 in target_get_config_value (buf=buf@entry=0x7fff1c7a3760 "1", buf_len=buf_len@entry=16, fmt=fmt@entry=0x40fea2 "PORT_OFFSET_MAP")
    at xx/xx/xp/bsd/target/bsg/libsrc/lib/attrs/src/bsg_utils.c:94
#9  0x0000000000408168 in ald_get_femu_config_vlaue () at xx/kedu/sources/fwd/sld/src/sld.c:712
#10 0x0000000000408d67 in main (argc=1, argv=0x7fff1c7a3988) at xx/xx/xx/fwd/sld/src/sld.c:1061

I have following queries here.

1. what is the checkhdr() error.
2. any more defensive program i should use to overcome this getline() and free() crash.


Thanks
Rama

Really hard to say what the problem is without seeing any source code. If you post it, please make sure it's well formatted and post it in [code][/code] tags.

You can also try Valgrind and Electric Fence to help you debug.

Thanks anduril,

I have pasted my code here.. pastebin - Unnamed - post number 3694480

When i run with Valgrind it never shows up this error. In documentation i learned the native execution memory layout would be different compared to valgrind, this might result in issue not surfacing.

You missed the part about posting it in code tags. Please just post the code here, so anybody looking at the thread can easily following along.

Code:

get_config_value (
    char *buf,
    size_t buf_len,
    const char *fmt,
    ...)
{
    FILE *fp;
    char *line = NULL;
    size_t len = 0;
    ssize_t read;
    va_list argp;
    char var[128];
    api_rc_t rc = 4;


    fp = fopen(CONFIG, "r");
    if (fp == NULL) {
        return (3);
    }


    va_start(argp, fmt);
    vsnprintf(var, sizeof(var), fmt, argp);
    va_end(argp);


    while ((read = getline(&line, &len, fp)) != -1) {
        char *tok;
        char *val;


        /* check for comment.  not very robust. */
        if (line[0] == '#') {
            continue;
        }


        /* get token. */
        tok = strtok(line, "=");
        if (!tok) {
            continue;
        }


        if (strcmp(tok, var)==0) {
            val = strtok(NULL, "=\n\r\t");
            if (!val) {
                rc = 3;
            } else {
                if (buf && buf_len) {
                    strncpy(buf, val, buf_len);
                }
                rc = API_OK;
            }
            break;
        }
    }


    if (rc == 2) {
        /* variable was not found. */
    }


    if (line) {
        free(line);
    }
    fclose(fp);
    return (rc);
}

I don't see any glaring memory issues off hand. However, it's possible that some other code is responsible for the corruption, such as the code that calls get_config_value. In particular, I notice from the trace that buf contains "1" but is said to be of size 16. Are you sure that is correct? Does buf actually have space for 16 bytes? If you write past the end of buf with your strncpy on line 51, this could cause the corruption.

One other note: Line 40 is pointless. If the first call to strtok doesn't find the delimiter, it returns the whole string, not NULL.