Strange problems in the old libc malloc routines

[John Baldwin]

On Wednesday, February 02, 2011 01:04:15 pm Andrew Duane wrote:
> We are still using the FreeBSD 6 malloc routines, and are rather suddenly
> having a large number of problems with one or two of our programs. Before
> I dig into the 100+ crash dumps I have, I thought I'd see if anyone else
> has ever encountered this.
> 
> The problems all seem to stem from some case of malloc returning the
> pointer "1" instead of either NULL or a valid pointer. Always exactly "1".
> Where this goes bad depends on where it happens (in the program or inside
> malloc itself), but that pointer value of "1" is always involved. Some of
> the structures like page_dir look corrupted too. It seems as if maybe the
> "1" is coming from sbrk(0) which is just returning the value of curbrk
> (which is correct, and not even close to "1").

Could it be related to calls to malloc(0) perhaps?  phkmalloc uses a constant 
for those that defaults to the last byte in a page (e.g. 4095 on x86).  I'm 
not sure what platform you are using malloc on, but is it possible that you 
have ZEROSIZEPTR set to 1 somehow?  Even so, if that is true free() should 
just ignore that pointer and not corrupt its internal state.

-- 
John Baldwin