Re: double free or corruption in base Rev. 39909 2016-06-22 16:14:05

[Richard Frith-Macdonald]

> On 24 Jun 2016, at 22:58, Pirmin Braun <address@hidden> wrote:
> 
> On Fri, 24 Jun 2016 05:55:03 +0100
> Richard Frith-Macdonald <address@hidden> wrote:
> 
>>> 
>>> 
>>> but then I did the same in plain C (see Test_MariaDB_main.c) and there it 
>>> works. Or in other words: when I remove the ObjC runtime and the very 
>>> little ObjC stuff, the crash doesn't occur.
>> 
>> That's not really telling indicative of anything ... different code has 
>> memory laid out differently, so overruns will write on different parts of 
>> the memory and cause different crashes (or often no crash at all).
>> You therefore have to assume that the problem could be anywhere, and try to 
>> narrow it down using frequent checks (mcheck_protect etc).
>> There is also the problem that adding calls to diagnostic functions could in 
>> itself hide the bug ... so non-intrusive methods like valgrind are also 
>> worth trying.
>> 
> 
> it's indeed the MariaDB Client Library.
> 
> Valgrind reports:
> ==2955== Invalid write of size 1
> ==2955==    at 0x4E5228D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E5288D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E52B96: mysql_real_query (in 
> /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4007B7: executeSQL (Test_MariaDB_main.c:22)
> ==2955==    by 0x4008C3: main (Test_MariaDB_main.c:55)
> ==2955==  Address 0x63d4228 is 0 bytes after a block of size 8,152 alloc'd
> ==2955==    at 0x4C28C20: malloc (vg_replace_malloc.c:296)
> ==2955==    by 0x4E5AEE8: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E58E26: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E52216: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E5288D: ??? (in /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4E52B96: mysql_real_query (in 
> /usr/lib/x86_64-linux-gnu/libmariadb.so.2)
> ==2955==    by 0x4007B7: executeSQL (Test_MariaDB_main.c:22)
> ==2955==    by 0x4008C3: main (Test_MariaDB_main.c:55)
> 
> on the version with the crashing query string in both test programs - ObjC 
> and C.
> Only difference is, ObjC program crashes and C doesn't.
> With the slightly modified query string valgrind reports no invalid write.


Thanks for letting us know.