hatrack icon indicating copy to clipboard operation
hatrack copied to clipboard

Getting "malloc: Double free" error when overwriting keys too often

Open mallman opened this issue 1 year ago • 22 comments

I haven't quite nailed down the exact circumstances in which this bug occurs, but I think you can reliably reproduce it by modifying examples/basic.c to add multiple calls to hatrack_dict_put(envp_dict, env_key, env_val) in the same loop iteration when populating envp_dict, like so:

    while (envp[i]) {
        p       = envp[i];
        env_eq  = strchr(p, '=');
        env_key = strndup(p, env_eq - p);
        env_val = strdup(env_eq + 1);

        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);
        hatrack_dict_put(envp_dict, env_key, env_val);

        i++;
    }

Obviously, this depends on the number of environment variables. I have about 40. Just add more calls hatrack_dict_put(envp_dict, env_key, env_val) if you still don't trigger the bug.

I think this is related to the value of HATRACK_RETIRE_FREQ, because the bug occurs in the function call to mmm_empty() in mmm_retire() in mmm.c.

I'm running this on an M1 macOS 13.4 with Xcode 14.3.1 clang:

Apple clang version 14.0.3 (clang-1403.0.22.14.1)
Target: arm64-apple-darwin22.5.0
Thread model: posix
InstalledDir: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin

I configured hatrack from scripts/config-debug.

Thank you!

mallman avatar Jun 20 '23 18:06 mallman