clamd memory corruption (may be jemalloc related)

[Peter Jeremy]

On 2007-Apr-20 03:22:26 +0400, Anton Yuzhaninov <citrin at citrin.ru> wrote:
>Clamav code quality is low, and probably it has bugs :(
>But not obvious how to find this bugs.

This smells like memory is being allocated in one thread and then
being referenced in another thread before it is initialised.

My initial suggestion is to put wrappers around malloc(3) family calls
(or the program's own internal wrapper functions) that dump __FILE__,
__LINE__ and pthread_self(), together with size and address
information.  The core dump will let you identify the thread that has
detected the problem as well as the offending block of memory.  The
malloc debug output will let you detect where that block of memory is
being allocated.  It's then just a simple matter of working out the
path from the latter to the former :-).

Of course, since this appears to be a race condition between threads,
it's quite likely it will be a heisenbug.

-- 
Peter Jeremy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20070420/2525d751/attachment.pgp