bugmake - Bugs: bug #11372, Function variable_expand_string()...

 
 

bug #11372: Function variable_expand_string() generates address out of range

Submitted by:  Darren Hiebert <dhiebert>
Submitted on:  Tue 21 Dec 2004 11:15:07 PM UTC  
 
Severity: 3 - NormalItem Group: Bug
Status: DuplicatePrivacy: Public
Assigned to: NoneOpen/Closed: Closed
Component Version: 3.80Operating System: POSIX-Based
Fixed Release: NoneTriage Status: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 27 Dec 2004 07:14:27 PM UTC, comment #5:

Problem fixed by patch for bug #1517.

Darren Hiebert <dhiebert>
Fri 24 Dec 2004 08:55:23 PM UTC, comment #4:

I believe this is a duplicate of bug #1517. Please try the patch there and attach a note to this bug if it doesn't solve your problem.

Paul D. Smith <psmith>
Project Administrator
Wed 22 Dec 2004 09:23:01 PM UTC, comment #3:

I have now narrowed the problem down to a very small reproducible example, which I have attached.

Darren Hiebert <dhiebert>
Tue 21 Dec 2004 11:43:10 PM UTC, comment #2:

Following down the calls through handle_function() to expand_builtin_function() to func_eval() to eval_buffer() shows that it is the call to eval() which changes `variable_buffer' out from under `op' of expand.c:235.

I note that the "eval" built-in was introduced in make-3.80, and probably has bugs to still work out (yes, I was trying to use eval, but my make files are far too complex to provide an example that can be reproduced). I hope that my work here can be of some value.

Darren Hiebert <dhiebert>
Tue 21 Dec 2004 11:27:00 PM UTC, comment #1:

Further investigation shows that after the call to handle_function() at expand.c:235, `variable_buffer' has been reallocated, moving it to a higher memory address, while leaving `op' pointing inside the former area (from which `o' is reassigned).

Darren Hiebert <dhiebert>
Tue 21 Dec 2004 11:15:07 PM UTC, original submission:

While attempting to use parameterized macros, I ended up with make generating a "virtual memory exhausted" error.

I have been looking at the source code for make and executing my makefile in the debugger and found that the problem is caused by the function variable_buffer_output() being called by variable_expand_string() with argument `ptr' having a memory value less than `variable_buffer' (i.e. `ptr' is not within the memory allocated to `variable_buffer'. This in turn causes the difference calculation at line expand.c:59 to produce a negative value, which ends up assigning a very large unsigned value to `newlen' (greater than 4 billion), thereby causing xrealloc() to generate a "virtual memory exhausted" error.

The comment for variable_buffer_output() states that "the value returned by each call to variable_buffer_output should be the first argument to the following call." However, from examination of variable_expand_string() shows that the value of `o' returned from a call to variable_output_buffer() can be overwritten at lines 237, 342, 346, and 360 of expand.c, which I believe must be happening. Apparently one of these lines is setting the value of `o' to a area outside the allocated area for `variable_buffer'.

Darren Hiebert <dhiebert>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #2254:  eval_bug.tar.gz added by dhiebert (1KiB - application/gzip - Reproducible example of bug)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 24 Dec 2004 08:55:23 PM UTCpsmithStatusNone=>Duplicate
  Open/ClosedOpen=>Closed
Wed 22 Dec 2004 09:23:01 PM UTCdhiebertAttached File-=>Added eval_bug.tar.gz, #1993

Back to the top


Powered by Savane 3.1-cleanup1