• Bug#878159: libc6: posix_memalign(): free(): invalid next size (fast)

    From Jakub Wilk@21:1/5 to All on Fri Oct 13 01:10:12 2017
    XPost: linux.debian.bugs.dist

    Adding forgotten attachment...

    --
    Jakub Wilk

    #include <stdlib.h>
    #include <stdint.h>

    int main(int argc, char **argv)
    {
    void *p;
    return posix_memalign(&p, 0x10, SIZE_MAX - 0x20);
    }

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Jakub Wilk@21:1/5 to All on Fri Oct 13 01:00:08 2017
    XPost: linux.debian.bugs.dist

    Package: libc6
    Version: 2.24-17

    Some posix_memalign() calls fail catastrophically:

    $ grep memalign test-posix-memalign.c
    return posix_memalign(&p, 0x10, SIZE_MAX - 0x20);

    $ make test-posix-memalign
    cc test-posix-memalign.c -o test-posix-memalign

    $ ./test-posix-memalign
    *** Error in `./test-posix-memalign': free(): invalid next size (fast): 0x57a96008 ***
    ...

    Backtrace:

    #0 0xf7fd7dc9 in __kernel_vsyscall ()
    #1 0xf7e2add0 in __libc_signal_restore_set (set=0xffffd160) at ../sysdeps/unix/sysv/linux/nptl-signals.h:79
    #2 __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:48
    #3 0xf7e2c297 in __GI_abort () at abort.c:89
    #4 0xf7e6638f in __libc_message (do_abort=<optimized out>, fmt=<optimized out>) at ../sysdeps/posix/libc_fatal.c:175
    #5 0xf7e6cfc7 in malloc_printerr (action=<optimized out>, str=0xf7f60318 "free(): invalid next size (fast)", ptr=<optimized out>, ar_ptr=0xf7fb2780 <main_arena>) at malloc.c:5049
    #6 0xf7e6d806 in _int_free (av=av@entry=0xf7fb2780 <main_arena>, p=p@entry=0x56558000, have_lock=have_lock@entry=1) at malloc.c:3905
    #7 0xf7e6f8c3 in _int_memalign (av=av@entry=0xf7fb2780 <main_arena>, alignment=alignment@entry=16, bytes=bytes@entry=4294967263) at malloc.c:4497
    #8 0xf7e70eea in _mid_memalign (alignment=16, bytes=4294967263, address=<optimized out>) at malloc.c:3158
    #9 0xf7e71028 in _mid_memalign (alignment=alignment@entry=16, bytes=bytes@entry=4294967263, address=<optimized out>) at malloc.c:3121
    #10 0xf7e72b7f in __posix_memalign (memptr=0xffffd6ac, alignment=16, size=4294967263) at malloc.c:5071
    #11 0x5655556b in main ()


    -- System Information:
    Architecture: i386

    Versions of packages libc6 depends on:
    ii libgcc1 1:7.2.0-8


    --
    Jakub Wilk

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)