apr-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 40955] New: - allocator_free may leak nodes
Date Mon, 13 Nov 2006 10:30:30 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40955>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=40955

           Summary: allocator_free may leak nodes
           Product: APR
           Version: HEAD
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: normal
          Priority: P2
         Component: APR
        AssignedTo: bugs@apr.apache.org
        ReportedBy: peter.steiner+apache@hugwi.ch


As Brian Pane reported [1], current_free_index in allocator_free may underflow
to 2^32-1. Though the report dates almost a year back, I couldn't find any
correction or patch in the trunk or in bugzilla.

I have observed [2] a situation where this problem leads to losing a pointer to
a still allocated node, when a second node is freed. The pointer to this second
node is stored to allocator->free[index] (index == 1), thus overwriting the
pointer to the first node.

This leads to a leak of 8k (the default node size).

[1] "apr_allocator Re: Event MPM: Spinning on cleanups?"
http://mail-archives.apache.org/mod_mbox/httpd-dev/200512.mbox/%3CA99202F3-A131-4656-8A68-7574C9E9062F@apache.org%3E

[2] http://www.mail-archive.com/log4cxx-user@logging.apache.org/msg01708.html

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Mime
View raw message