malloc(1/0) ??
[email protected] asked:
Quoted 9 lines
[Why does this program not crash?]
main(){ char *s; s = (char*)malloc(0); strcpy(s,"fffff"); printf("%s\n",s); }
It doesn't crash because the standard malloc is
optimized for speed, not for finding bugs.
Try linking it with a debugging malloc, e.g.
cc bug.c -lefence
and watch it dump core.
- Dan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/
From: "Dan Kegel" <[email protected]>
Quoted 11 lines
[email protected] asked:
Quoted 9 lines
[Why does this program not crash?]
main(){ char *s; s = (char*)malloc(0); strcpy(s,"fffff"); printf("%s\n",s); }
Quoted 6 lines
It doesn't crash because the standard malloc is
optimized for speed, not for finding bugs.Try linking it with a debugging malloc, e.g.
ccbug.c-lefence
and watch it dump core.
I'm not sure that is fully responsive, Dan. Why doesn't the strcpy throw a hissyfit and coredump?
{^_^}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/
Quoted 15 lines
From: "Dan Kegel" <[email protected]>
Quoted 14 lines
[email protected] asked:
Quoted 9 lines
[Why does this program not crash?]
main(){ char *s; s = (char*)malloc(0); strcpy(s,"fffff"); printf("%s\n",s); }It doesn't crash because the standard malloc is
optimized for speed, not for finding bugs.
Quoted 6 lines
Quoted 3 lines
Try linking it with a debugging malloc, e.g.
ccbug.c-lefence
and watch it dump core.I'm not sure that is fully responsive, Dan. Why doesn't the strcpy throw a hissyfit and coredump?
Why should it? Do you think that when you allocate memory, the chunk of
mappable memory you got always ends on the exact byte you asked it to? When you invoke undefined behavior, anything can happen.
DS
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/
Quoted 3 lines
I'm not sure that is fully responsive, Dan. Why doesn't the strcpy throw a hissyfit and coredump?
Because he's a lucky guy and doesn't cross a page boundary. If the "ffff" thing is the entire Wind95 source code it will dump :-)
Quoted 1 line
{^_^}
Igmar
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/