David wrote:
 I have a program that uses
multiple threads to accomplish a proxy for other protocols, but my
issue really is that sometimes.... and only sometimes... the program
crashes with a bus error.  At the base of the core dump is always the
free function... and somewhere in the trace is the PR_Close function.

#0  0xfeb42bbc in _free_unlocked () from /usr/lib/libc.so.1
#1  0xfeb42b74 in free () from /usr/lib/libc.so.1
#2  0xfec2ebc4 in PR_Free (ptr=0x61737465) at
../../../../pr/src/malloc/prmem.c:456
#3  0xfee95580 in PORT_Free (ptr=0x61737465) at secport.c:149

This crash always means one thing: heap corruption. heap corruption may be caused by any of the following (among others) - double frees (and double closes) - freeing addresses that were not returned by malloc - writing past the end of an allocated buffer - continuing to use a pointer to allocated memory after that memory has been freed. - wild stores - insufficient mutual exclusion for acccess to memory resources shared by multiple threads.

When a crash occurs, it is almost ALWAYS true that the stack in which
the crash occurs is a VICTIM, not the cause.  The damage has been done
by some erroneous code before the particular free or malloc call that
experiences the crash.  The victim just happened to touch a buffer that
was corrupted.  Perhaps the buffer just before it in memory was overrun,
corrupting the allocation block headers for another block (let's call it
the victim block), and when that victim block is freed, boom.

PR_Close does a lot of freeing of previously allocated buffers.  If any
other those buffers have been previously corrupted, PR_Close is the
MOST likely piece of code to fall victim, since it has the task of freeing
all the socket-related memory allocations.  This does not indicate that
PR_Free is doing anything wrong, nor the functions that it calls.

Let me suggest that you try some different tools. Maybe valgrind has
helped you as much as it can. Try a heap library with specific debugging abilities. Solaris has one or more of those.


--
Nelson B
_______________________________________________
mozilla-crypto mailing list
[email protected]
http://mail.mozilla.org/listinfo/mozilla-crypto

Reply via email to