From owner-freebsd-bugs@FreeBSD.ORG Wed Mar 31 05:00:31 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 30A6316A4CF for ; Wed, 31 Mar 2004 05:00:31 -0800 (PST) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0EAD543D62 for ; Wed, 31 Mar 2004 05:00:31 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i2VD0Ubv076184 for ; Wed, 31 Mar 2004 05:00:30 -0800 (PST) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i2VD0UpM076183; Wed, 31 Mar 2004 05:00:30 -0800 (PST) (envelope-from gnats) Resent-Date: Wed, 31 Mar 2004 05:00:30 -0800 (PST) Resent-Message-Id: <200403311300.i2VD0UpM076183@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, JINMEI Tatuya Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B334B16A4CE for ; Wed, 31 Mar 2004 04:58:58 -0800 (PST) Received: from shuttle.wide.toshiba.co.jp (shuttle.wide.toshiba.co.jp [202.249.10.124]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4DCC943D49 for ; Wed, 31 Mar 2004 04:58:58 -0800 (PST) (envelope-from jinmei@shuttle.wide.toshiba.co.jp) Received: from shuttle.wide.toshiba.co.jp (localhost [::1]) by shuttle.wide.toshiba.co.jp (Postfix) with ESMTP id 7417315218 for ; Wed, 31 Mar 2004 21:58:56 +0900 (JST) Received: (from jinmei@localhost)i2VCwuqj034068; Wed, 31 Mar 2004 21:58:56 +0900 (JST) Message-Id: <200403311258.i2VCwuqj034068@shuttle.wide.toshiba.co.jp> Date: Wed, 31 Mar 2004 21:58:56 +0900 (JST) From: JINMEI Tatuya To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: bin/64991: malloc(3) crashes with some large parameters X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: JINMEI Tatuya List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2004 13:00:31 -0000 >Number: 64991 >Category: bin >Synopsis: malloc(3) crashes with some large parameters >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Mar 31 05:00:30 PST 2004 >Closed-Date: >Last-Modified: >Originator: JINMEI Tatuya >Release: FreeBSD 4.9-RELEASE i386 >Organization: the KAME Project >Environment: System: FreeBSD ocean.jinmei.org 4.9-RELEASE FreeBSD 4.9-RELEASE #22: Wed Mar 10 21:19:49 JST 2004 jinmei@ocean.jinmei.org:/home/jinmei/src/kame/kame/freebsd4/sys/compile/SS2010_SCTP i386 Toshiba Portege 2000 FreeBSD 4.9 (with some recent KAME snaps, which should not matter though) >Description: malloc(3) dumps core for large size parameters around 0xffff0000. >How-To-Repeat: Compile the following code and execute it. Then something similar to the following should happen: % ./foo malloc: Cannot allocate memory zsh: 2153 segmentation fault (core dumped) ./foo #include #include #include #include main() { char *p; p = (char *)malloc(0x8fff0000); if (p == NULL) perror("malloc"); else free(p); p = (char *)malloc(0xffff0000); if (p == NULL) perror("malloc"); exit(0); } >Fix: I don't have one. >Release-Note: >Audit-Trail: >Unformatted: