[Python-bugs-list] [ python-Bugs-782689 ] PyObject_Free unallocated memory read warning

[SourceForge.net]

Bugs item #782689, was opened at 2003-08-04 10:38
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=782689&group_id=5470

Category: Python Interpreter Core
Group: Python 2.3
Status: Open
Resolution: None
Priority: 5
Submitted By: Grzegorz Makarewicz (makaron)
Assigned to: Nobody/Anonymous (nobody)
Summary: PyObject_Free unallocated memory read warning

Initial Comment:
win2k, vc6sp5

ADDRESS_IN_RANGE(p, pool->arenaindex)) is too simple
and may read unmanaged memory when "p" does not belong
to selected pool and there is something allocated by
python allocator and pool->arenaindex is smaller than
narenas (random case).

valgrind messages for PyObject_Free line 711:
Conditional jump or move depends on uninitialised value(s)
Use of uninitialised value of size 4
Invalid read of size 4

simple test:
#include <stdio.h>

extern void *PyObject_Malloc(int size);
extern void PyObject_Free(void *mem);


void main() {
	void *p0;
	void *p;
	int i;

	p0 = PyObject_Malloc(100);
	for(i = 1; i < 512; i++ ){
		p = PyObject_Malloc(i);
		PyObject_Free(p);
	}
	PyObject_Free(p0);
}


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=782689&group_id=5470