You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@apr.apache.org by Blair Zajac <bl...@orcaware.com> on 2002/07/31 23:30:59 UTC
[PATCH] apr_pools.c patch for bounds checking compiler
I'm using the bounds checking gcc 3.1.1 to check for memory issues
in Apache and Subversion. This patch to gcc compiles the code with
extra checks for illegal memory accesses, invalid pointers, etc and
runs a lot faster than valgrind. See
http://web.inter.nl.net/hcc/Haj.Ten.Brugge/
There's a core dump from the bounds checking compiler when running
httpd -l with today's HEAD
% /opt/i386-linux/installed/apache-2.0-cvs-2002073101/bin/httpd -l
Bounds Checking GCC v gcc-3.1.1-3.1 Copyright (C) 1995 Richard W.M. Jones
Bounds Checking comes with ABSOLUTELY NO WARRANTY. For details see file
`COPYING' that should have come with the source to this program.
Bounds Checking is free software, and you are welcome to redistribute it
under certain conditions. See the file `COPYING' for details.
For more information, set GCC_BOUNDS_OPTS to `-help'
apr_pools.c:617:Bounds error: NULL or ILLEGAL pointer used in <, >, <= or >= of pointers.
apr_pools.c:617: Left pointer value: ILLEGAL
apr_pools.c:617: Right pointer value: 0x81a0000
Abort (core dumped)
This is at
APR_DECLARE(void *) apr_palloc(apr_pool_t *pool, apr_size_t size)
...
size = APR_ALIGN_DEFAULT(size);
active = pool->active;
/* If the active node has enough bytes left, use it. */
endp = active->first_avail + size;
if (endp < active->endp) {
The bounds checking httpd checks if
endp = active->first_avail + size
is a valid pointer into the buffer and sets endp to (void *)-1 if it
is not and then core dumps on the "if (endp < active->endp)" test.
endp may be set to -1 because endp points past the end of the memory
buffer (past active->endp) and hence is not a valid pointer according
to the ISO standard.
The patch changes the test to
if (size <= active->endp - active->first_avail) {
and only computes active->first_avail + size if the pointer will be
valid.
The only question is if the <= should be a <.
Even without this issue, should the test "if (endp < active->endp)" be
"if (endp <= active->endp)"? Otherwise there may be wasted memory in
this buffer?
Best,
Blair
--
Blair Zajac <bl...@orcaware.com>
Web and OS performance plots - http://www.orcaware.com/orca/
RE: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Sander Striker <st...@apache.org>.
> From: Blair Zajac [mailto:blair@orcaware.com]
> Sent: 06 August 2002 19:53
> Sander Striker wrote:
>>> Blair Zajac wrote:
>>>> I'm using the bounds checking gcc 3.1.1 to check for memory issues
>>>> in Apache and Subversion. This patch to gcc compiles the code with
>>>> extra checks for illegal memory accesses, invalid pointers, etc and
>> [...]
>>
>> Hi Blair,
>>
>> Thanks for the patch. I'll review and commit this within a day or two.
>>
>> Sander
>
> Hi Sander,
>
> Have you had an opportunity to review the patch?
Yes, I have. Thanks for reminding me that I still need to integrate and
commit it ;).
Sander
Re: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Blair Zajac <bl...@orcaware.com>.
Sander Striker wrote:
>
> > From: Blair Zajac [mailto:blair@orcaware.com]
> > Sent: 06 August 2002 19:53
>
> > Sander Striker wrote:
> > >
> > > > From: Blair Zajac [mailto:blair@orcaware.com]
> > > > Sent: 01 August 2002 01:10
> > >
> > > > Blair Zajac wrote:
> > > >>
> > > >> I'm using the bounds checking gcc 3.1.1 to check for memory issues
> > > >> in Apache and Subversion. This patch to gcc compiles the code with
> > > >> extra checks for illegal memory accesses, invalid pointers, etc and
> > > [...]
> > >
> > > Hi Blair,
> > >
> > > Thanks for the patch. I'll review and commit this within a day or two.
> > >
> > > Sander
> >
> > Hi Sander,
> >
> > Have you had an opportunity to review the patch?
>
> Applied. Thanks!
>
> Sander
Great! Thanks.
Blair
--
Blair Zajac <bl...@orcaware.com>
Web and OS performance plots - http://www.orcaware.com/orca/
RE: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Sander Striker <st...@apache.org>.
> From: Blair Zajac [mailto:blair@orcaware.com]
> Sent: 06 August 2002 19:53
> Sander Striker wrote:
> >
> > > From: Blair Zajac [mailto:blair@orcaware.com]
> > > Sent: 01 August 2002 01:10
> >
> > > Blair Zajac wrote:
> > >>
> > >> I'm using the bounds checking gcc 3.1.1 to check for memory issues
> > >> in Apache and Subversion. This patch to gcc compiles the code with
> > >> extra checks for illegal memory accesses, invalid pointers, etc and
> > [...]
> >
> > Hi Blair,
> >
> > Thanks for the patch. I'll review and commit this within a day or two.
> >
> > Sander
>
> Hi Sander,
>
> Have you had an opportunity to review the patch?
Applied. Thanks!
Sander
Re: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Blair Zajac <bl...@orcaware.com>.
Sander Striker wrote:
>
> > From: Blair Zajac [mailto:blair@orcaware.com]
> > Sent: 01 August 2002 01:10
>
> > Blair Zajac wrote:
> >>
> >> I'm using the bounds checking gcc 3.1.1 to check for memory issues
> >> in Apache and Subversion. This patch to gcc compiles the code with
> >> extra checks for illegal memory accesses, invalid pointers, etc and
> [...]
>
> Hi Blair,
>
> Thanks for the patch. I'll review and commit this within a day or two.
>
> Sander
Hi Sander,
Have you had an opportunity to review the patch?
Best,
Blair
--
Blair Zajac <bl...@orcaware.com>
Web and OS performance plots - http://www.orcaware.com/orca/
RE: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Sander Striker <st...@apache.org>.
> From: Blair Zajac [mailto:blair@orcaware.com]
> Sent: 01 August 2002 01:10
> Blair Zajac wrote:
>>
>> I'm using the bounds checking gcc 3.1.1 to check for memory issues
>> in Apache and Subversion. This patch to gcc compiles the code with
>> extra checks for illegal memory accesses, invalid pointers, etc and
[...]
Hi Blair,
Thanks for the patch. I'll review and commit this within a day or two.
Sander
Re: [PATCH] apr_pools.c patch for bounds checking compiler
Posted by Blair Zajac <bl...@orcaware.com>.
Blair Zajac wrote:
>
> I'm using the bounds checking gcc 3.1.1 to check for memory issues
> in Apache and Subversion. This patch to gcc compiles the code with
> extra checks for illegal memory accesses, invalid pointers, etc and
> runs a lot faster than valgrind. See
>
> http://web.inter.nl.net/hcc/Haj.Ten.Brugge/
>
> There's a core dump from the bounds checking compiler when running
> httpd -l with today's HEAD
>
Here's an updated patch with an additional change that was caught with
Subversion's make check, replacing
- if (!ps->got_a_new_node && node->first_avail + size < node->endp) {
with
+ if (!ps->got_a_new_node && node->endp - node->first_avail > size) {
Best,
Blair
--
Blair Zajac <bl...@orcaware.com>
Web and OS performance plots - http://www.orcaware.com/orca/