New / malloc / threads core dump

Question

Hi,
I'm trying to port a ftp client from Linux to Solaris. The client runs fine on both Linux and on *BSD.
I'm using the Sun Studio 8 C++ compiler on Solaris 9 4/04 x86.
The program crashes in the below class function:
-- CUT --
FILELIST CServer::ObtainFilelist(bool use_jump) {
FILELIST fl_temp, fl_temp1 = NULL, fl_new, fl_start = NULL;
pthread_mutex_lock(&(this->filelist_lock));
fl_temp = this->actual_filelist;
while (fl_temp) {
fl_new = new(FILELIST);
fl_new->next = NULL;
fl_new->magic = fl_temp->magic;
fl_new->is_marked = FALSE;
fl_new->name = new(char[strlen(fl_temp->name) + 1]);
if (!fl_temp1)
fl_start = fl_new;
else
fl_temp1->next = fl_new;
fl_temp1 = fl_new;
fl_temp = fl_temp->next;
pthread_mutex_unlock(&(this->filelist_lock));
*use_jump = this->prefs.use_jump;
return (fl_start);
-- CUT --
When running the program in dbx I get:
-- CUT --
t@2 (l@2) signal SEGV (no mapping at the fault address) in smalloc at 0xd2f20b09 0xd2f20b09: smalloc+0x0078: movl 0x00000008(%eax),%ecx
Current function is CServer::ObtainFilelist
1815 und bookfl_new->name = new(char[strlen(fl_temp->name) + 1]);
(dbx) where
current thread: t@2
[1] _smalloc(0x8), at 0xd2f20b09
[2] mallocunlocked(0x8), at 0xd2f20d66
[3] malloc(0x5), at 0xd2f20b57
[4] operator new(0x5), at 0xd2ff5d8c
=>[5] CServer::ObtainFilelist(this = 0x839d328, use_jump = 0xd2d8df33), line 1815 in "server.cc"
[6] CDisplayHandler::UpdateServerFilelist(this = 0x80c53a0, server = 0x839d328, window = 0x80eb600), line 1692 in "displayupdate.cc"
[7] CDisplayHandler::HandleServerMessage(this = 0x80c53a0, msg = 2, magic = 1, data = (nil)), line 4596 in "displayhandler.cc"
[8] CDisplayHandler::Loop(this = 0x80c53a0), line 4841 in "displayhandler.cc"
[9] DetachDisplayHandler(dummy = (nil)), line 302 in "main.cc"
[10] thrsetup(0xd2e30200), at 0xd2e54513
[11] lwpstart(), at 0xd2e54790
-- CUT --
I tried to replace the "fl_new->name = new(char[strlen(fl_temp->name) + 1]);" with "fl_new-name new char [255]" with success. fl_temp->name is accessible, I tried to output the contents before doing the new with success.
FILELIST is a struct and FILELIST.name is a char*.
Any help would be really appreciated.martin@sara# CC -V
CC: Sun C++ 5.5 2003/03/12
martin@sara# uname -a
SunOS sara 5.9 Generic_112234-12 i86pc i386 i86pc
Regards,
Martin Andersson

Answer 1

The stack trace seems to show a core dump from malloc after being asked to allocate 5 bytes. (The operator new in the standard library calls malloc to allocate storage.)
If your code was compiled optimized and without -g, the stack trace is not always reliable, however.
But assuming the trace is accurate, the crash is probably due to a corrupted heap. An invalid free() or delete can corrupt the heap data structures, and the the crash occurs at at later time, often far removed from the offending location. "Invalid" means
- using the wrong form of delete
-deleting an address that was not provided by the matching new operator
-freeing an address that was not provided by malloc/calloc/realloc
-freeing or deletting the same block more than once
The heap (and anything else in the program) can also become corrupted by storing through an invalid pointer or an uninitialized pointer. "Invalid" means the object pointed to no longer exists.
The heap can also become corrupted if you store beyond the bounds of allocated storage.
The classic error is this:
char* p = new char[strlen(msg)]; // forgot about trailing null
strcpy(p, msg); // write one byte too many
If you can't see any of these errors in the souce code (and theyare hard to find), try running under dbx with RTC (run-time checking) enabled, or use some memory debugger.