From: philip@cel.cummins.com (Philip D. Pokorny)
Subject: Re: Building Pine/Pico
Organization: Electrotechnical Laboratory, Tsukuba Science City
Distribution: fj
Date: Wed, 22 Jul 1992 16:41:28 GMT
Return-Path: <apollo-list-errors@srvr1.engin.umich.edu>

Ian Hoyle asks:
> I am in the middle of trying to get the MIME compatible mail front
> end called Pine (and it's associated editor Pico) up and running
> on our Apollos under bsd and sr10.3.4/cc6.8. I am using the latest 3.02
> version of pine/pico from ftp.cac.washington.edu announced last week BTW.
> 
> Pico is crashing with memory allocation problems. A snapshot of
> the traceback yields:
> 
> Called from    "pfm_$fault" line 3253
> Called from    diagnostic frame (00040004) reference to illegal address (OS/MST
> manager)
> Called from    "malloc" line 209
> Called from    "lalloc" line 78
> Called from    "readbuf" line 407
> Called from    "pico" line 146
> Called from    "pine_send" line 523

If you use the -full option to tb, it will tell you the ADDRESS
that was attempted.  If this is 0, you are de-referencing the
NULL pointer.  If it's a sequence of hex bytes between 20 and
7f then chances are you have a memory overwrite bug and some
string data has written over a pointer.

> 
> Chasing down these line references it is the malloc call in the lalloc
> function causing it to drop it's bundle.
> 
> The actual code fragment looks like:
> 
> /*
>  * This routine allocates a block of memory large enough to hold a LINE
>  * containing "used" characters. The block is always rounded up a bit. Return
>  * a pointer to the new block, or NULL if there isn't any memory left. Print a
>  * message in the message line if no space.
>  */
> LINE    *
Uh...  What is the typedef of LINE?  I assume from code below
that it must look something like:

typedef struct LINE { long l_size, l_used ;
                      char  line[1];
            } LINE ;

Don't think it makes a difference, but it would help to know.

> lalloc(used)
> register int    used;
> {
>         register LINE   *lp;
>         register int    size;
>         char *malloc();
> 
> 
>         size = (used+NBLOCK-1) & ~(NBLOCK-1);

NBLOCK absolutely *must* be a power of 2 for this to work.  I'll
bet it is, but it's worth checking... 

>         if (size == 0)                          /* Assume that an empty */
>                 size = NBLOCK;                  /* line is for type-in. */
>         if ((lp = (LINE *) malloc(sizeof(LINE)+size)) == NULL) {
>                 return (NULL);
>         }
>         lp->l_size = size;
>         lp->l_used = used;
>         return (lp);
> }
> 
> 
> Looks internal to the malloc function to me, unless the arg to it is screwed:)

Yes it's internal to malloc, but those errors are almost always
caused by memory overwrite problems that trash the linked list
of memory blocks that malloc and free use.

> Are there any suggestions as to how I might solve this??

When porting patch recently, I found included a file with
malloc and free and other routines.  The nice thing about them
was that they were free, they were source code, and they have a
HEAP DEBUG option that you can throw at compile time to turn on
magic numbers before and after allocated blocks of memory to try
and catch memory overwrites.  If you've got patch, you might
check out those routines.

Good luck,


Sincerely,
Philip D. Pokorny
philip@cel.cummins.com
:)

Newsgroups: fj.mail-lists.apollo