Re: invalid free() in gawk 3.1.5

[Aharon Robbins]

Greetings. Re this:

> Date: Mon, 20 Feb 2006 17:33:55 +0100
> From: Arwed von Merkatz <address@hidden>
> Subject: invalid free() in gawk 3.1.5
> To: address@hidden
>
> Hi,
>
> when running gawk 3.1.5 on a non-existing file, it gets aborted by glibc
> due to an invalid free():
> address@hidden:~$ gawk '{ print }' invalid-filename
> *** glibc detected *** free(): invalid pointer: 0x080a1380 ***
> Aborted
>
> Here's the output of a valgrind run:
> address@hidden:~$ valgrind --tool=memcheck gawk '{ print }'
> invalid-filename
> ==13271== Memcheck, a memory error detector.
> ==13271== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et
> al.
> ==13271== Using LibVEX rev 1552, a library for dynamic binary
> translation.
> ==13271== Copyright (C) 2004-2005, and GNU GPL'd, by OpenWorks LLP.
> ==13271== Using valgrind-3.2.0.SVN, a dynamic binary instrumentation
> framework.
> ==13271== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et
> al.
> ==13271== For more details, rerun with: -v
> ==13271== 
> ==13271== Invalid free() / delete / delete[]
> ==13271==    at 0x4019116: free (in
> /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
> ==13271==    by 0x80724C0: iop_alloc (io.c:2498)
> ==13271==    by 0x8070BB3: iop_open (io.c:1602)
> ==13271==    by 0x806D5C6: nextfile (io.c:280)
> ==13271==    by 0x806DB9D: do_input (io.c:445)
> ==13271==    by 0x8074682: main (main.c:595)
> ==13271==  Address 0x80A1380 is not stack'd, malloc'd or (recently)
> free'd
> gawk: cmd. line:1: fatal: cannot open file `invalid-filename' for
> reading (No such file or directory)
> ==13271== 
> ==13271== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 15 from
> 1)
> ==13271== malloc/free: in use at exit: 4,333 bytes in 25 blocks.
> ==13271== malloc/free: 2,000 allocs, 1,976 frees, 78,557 bytes
> allocated.
> ==13271== For counts of detected errors, rerun with: -v
> ==13271== searching for pointers to 25 not-freed blocks.
> ==13271== checked 84,796 bytes.
> ==13271== 
> ==13271== LEAK SUMMARY:
> ==13271==    definitely lost: 0 bytes in 0 blocks.
> ==13271==      possibly lost: 0 bytes in 0 blocks.
> ==13271==    still reachable: 4,333 bytes in 25 blocks.
> ==13271==         suppressed: 0 bytes in 0 blocks.
> ==13271== Reachable blocks (those to which a pointer was found) are not
> shown.
> ==13271== To see them, rerun with: --show-reachable=yes
>
>
> This is on a system with glibc 2.3.6, gawk compiled with gcc 4.0.2.
>
> -- 
> Arwed v. Merkatz                              Source Mage GNU/Linux developer

This is a known problem. Patch attached.

Thanks,

Arnold
-----------------------------------
Fri Aug 12 13:10:33 2005  Arnold D. Robbins  <address@hidden>

        * io.c (iop_alloc): Only free `iop' if it was malloc'ed in
        the first place.

--- ../gawk-3.1.5/io.c  2005-07-26 21:07:43.000000000 +0300
+++ io.c        2005-08-12 13:10:28.000000000 +0300
@@ -2480,9 +2480,12 @@
 {
        struct stat sbuf;
        struct open_hook *oh;
+       int iop_malloced = FALSE;
 
-       if (iop == NULL)
+       if (iop == NULL) {
                emalloc(iop, IOBUF *, sizeof(IOBUF), "iop_alloc");
+               iop_malloced = TRUE;
+       }
        memset(iop, '\0', sizeof(IOBUF));
        iop->flag = 0;
        iop->fd = fd;
@@ -2495,7 +2498,8 @@
        }
 
        if (iop->fd == INVALID_HANDLE) {
-               free(iop);
+               if (iop_malloced)
+                       free(iop);
                return NULL;
        }
        if (isatty(iop->fd))