Re: double free or corruption in base Rev. 39909 2016-06-22 16:14:05

[Pirmin Braun]

On Fri, 24 Jun 2016 05:55:03 +0100
Richard Frith-Macdonald <address@hidden> wrote:

> > 
> > 
> > but then I did the same in plain C (see Test_MariaDB_main.c) and there it 
> > works. Or in other words: when I remove the ObjC runtime and the very 
> > little ObjC stuff, the crash doesn't occur.
> 
> That's not really telling indicative of anything ... different code has 
> memory laid out differently, so overruns will write on different parts of the 
> memory and cause different crashes (or often no crash at all).
> You therefore have to assume that the problem could be anywhere, and try to 
> narrow it down using frequent checks (mcheck_protect etc).
> There is also the problem that adding calls to diagnostic functions could in 
> itself hide the bug ... so non-intrusive methods like valgrind are also worth 
> trying.
> 

it's indeed the MariaDB Client Library.

Valgrind reports:
==2955== Invalid write of size 1
==2955==    at 0x4E5228D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E5288D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E52B96: mysql_real_query (in 
/usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4007B7: executeSQL (Test_MariaDB_main.c:22)
==2955==    by 0x4008C3: main (Test_MariaDB_main.c:55)
==2955==  Address 0x63d4228 is 0 bytes after a block of size 8,152 alloc'd
==2955==    at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==2955==    by 0x4E5AEE8: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E58E26: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E52216: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E5288D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4E52B96: mysql_real_query (in 
/usr/lib/x86_64-linux-gnu/libmariadb.so.2)
==2955==    by 0x4007B7: executeSQL (Test_MariaDB_main.c:22)
==2955==    by 0x4008C3: main (Test_MariaDB_main.c:55)

on the version with the crashing query string in both test programs - ObjC and 
C.
Only difference is, ObjC program crashes and C doesn't.
With the slightly modified query string valgrind reports no invalid write.


-- 
Pirmin Braun - IntarS Unternehmenssoftware GmbH - Creidlitzer Straße 106, 96450 
Coburg
+49 2642 40526292 +49 174 9747584 - skype:pirminb www.intars.de  address@hidden
Geschäftsführer: Pirmin Braun, Ralf Engelhardt Registergericht: Amtsgericht 
Coburg HRB3136