Mailing List Archive

libspf2 memory corruption (?)
Hi,

I am experiencing problems with libspf2. I have been trying various
versions starting with libspf2 1.0.4, and so far every version I tried
(up to the debian libspf 1.2.5.dfsg-4) is having the same problems.

In this case I'm trying with libspf 1.2.5.dfsg-4 (debian).

I have tried to contact the Debian maintainer for this package, but
haven't received any reply. The RT bug thingie also seems to be broken,
so I really hope some of you can help me out.

I am using this library like this:

SPF_server_t *spf_server = SPF_server_new(SPF_DNS_CACHE, 0);
SPF_request_t *spf_request = SPF_request_new(spf_server);
SPF_response_t *spf_response = NULL;

But as soon as I initialize the server, memory gets corrupted:

[PC: 0xb7d478cc] (Thread 0) **FREE_NULL**

Freeing null pointer.

Stack trace where the error occurred:
realloc() (interface)
SPF_record_compile_macro()
SPF_record_compile()
SPF_server_set_localpolicy()
SPF_server_new()
main() autoreply.c, 116

**Memory corrupted. Program may crash!!**

The above dump is from the binary debian package, below is the dump from
the (debian) source package:

[spf_compile.c:107] (Thread 0) **FREE_NULL**
>> *datap = realloc(*datap, size);

Freeing null pointer: *datap

Stack trace where the error occurred:
SPF_c_ensure_capacity() spf_compile.c, 107
SPF_c_mech_add() spf_compile.c, 831
SPF_record_compile() spf_compile.c, 1260
SPF_server_set_localpolicy() spf_server.c, 226
SPF_server_new() spf_server.c, 127
main() autoreply.c, 116

**Memory corrupted. Program may crash!!**

Most of the times my program survives, but sometimes my program does
indeed crash after it does some memory operations, so I have the feeling
my code checker (Insure++) is right and libspf2 is indeed trying to free
a null pointer.

I was wondering if I am doing something wrong. If not, is this a known
bug, and if so is there a fix available?

Please let me know if you need any additional information.

Sincerely yours,
Bas Verhoeven

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=1311533&id_secret=74245630-9d7477
Powered by Listbox: http://www.listbox.com
Re: libspf2 memory corruption (?) [ In reply to ]
On Monday 10 December 2007 11:50, Bas Verhoeven wrote:
> Hi,
>
> I am experiencing problems with libspf2. I have been trying various
> versions starting with libspf2 1.0.4, and so far every version I tried
> (up to the debian libspf 1.2.5.dfsg-4) is having the same problems.
>
> In this case I'm trying with libspf 1.2.5.dfsg-4 (debian).
>
> I have tried to contact the Debian maintainer for this package, but
> haven't received any reply. The RT bug thingie also seems to be broken,
> so I really hope some of you can help me out.
>
> I am using this library like this:
>
> SPF_server_t *spf_server = SPF_server_new(SPF_DNS_CACHE, 0);
> SPF_request_t *spf_request = SPF_request_new(spf_server);
> SPF_response_t *spf_response = NULL;
>
> But as soon as I initialize the server, memory gets corrupted:
>
> [PC: 0xb7d478cc] (Thread 0) **FREE_NULL**
>
> Freeing null pointer.
>
> Stack trace where the error occurred:
> realloc() (interface)
> SPF_record_compile_macro()
> SPF_record_compile()
> SPF_server_set_localpolicy()
> SPF_server_new()
> main() autoreply.c, 116
>
> **Memory corrupted. Program may crash!!**
>
> The above dump is from the binary debian package, below is the dump from
> the (debian) source package:
>
> [spf_compile.c:107] (Thread 0) **FREE_NULL**
>
> >> *datap = realloc(*datap, size);
>
> Freeing null pointer: *datap
>
> Stack trace where the error occurred:
> SPF_c_ensure_capacity() spf_compile.c, 107
> SPF_c_mech_add() spf_compile.c, 831
> SPF_record_compile() spf_compile.c, 1260
> SPF_server_set_localpolicy() spf_server.c, 226
> SPF_server_new() spf_server.c, 127
> main() autoreply.c, 116
>
> **Memory corrupted. Program may crash!!**
>
> Most of the times my program survives, but sometimes my program does
> indeed crash after it does some memory operations, so I have the feeling
> my code checker (Insure++) is right and libspf2 is indeed trying to free
> a null pointer.
>
> I was wondering if I am doing something wrong. If not, is this a known
> bug, and if so is there a fix available?
>
> Please let me know if you need any additional information.
>
The architecture and release you are using would be useful. Think of the
stuff that reportbug appends to a normal Debian bug report.

The libspf2 maintainer does respond to bugs, so since you're using the Debian
package, I'd suggest filing a bug in the Debian BTS.

Scott K

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=1311533&id_secret=74247432-0d8442
Powered by Listbox: http://www.listbox.com
Re: libspf2 memory corruption (?) [ In reply to ]
Bas Verhoeven wrote:

> SPF_response_t *spf_response = NULL;

It's years that I used C, but from your description I'd test:
SPF_response_t *spf_response = malloc( sizeof SPF_response_t );

Frank

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=1311533&id_secret=74266822-cf4a9b
Powered by Listbox: http://www.listbox.com
Re: Re: libspf2 memory corruption (?) [ In reply to ]
Frank Ellermann wrote:
> Bas Verhoeven wrote:
>
>> SPF_response_t *spf_response = NULL;
>
> It's years that I used C, but from your description I'd test:
> SPF_response_t *spf_response = malloc( sizeof SPF_response_t );

Nothing to do with that

> [spf_compile.c:107] (Thread 0) **FREE_NULL**
>>> *datap = realloc(*datap, size);
>
> Freeing null pointer: *datap

your (debugging) memory allocator is plain wrong here.
From "man -3 realloc":

"If ptr is NULL, the call is equivalent to malloc(size)"

so it is perfectly legal to invoke realloc() with NULL argument, it
should simply work like malloc() in this case.

Eugene

-------------------------------------------
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=1311533&id_secret=74282381-990a30
Powered by Listbox: http://www.listbox.com
Re: libspf2 memory corruption (?) [ In reply to ]
Eugene Crosser wrote:

> From "man -3 realloc":
> "If ptr is NULL, the call is equivalent to malloc(size)"

Thanks, my K&R 2nd ed. is old, it doesn't clearly say so.

Frank

-------------------------------------------
Archives: http://v2.listbox.com/member/archive/1007/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/1007/
Modify Your Subscription: http://v2.listbox.com/member/?member_id=1311533&id_secret=74329277-94ada6
Powered by Listbox: http://www.listbox.com