search for: free'ed

When using optional arguments of type OStringList, the code free'ing the member in the optargs_s struct corresponding to that optional argument would just check for a non-PyNone PyObject for that argument. If before that optional argument there are other arguments which can cause an earlier error return from that binding function, the free'ing code will...

...e point out if we are wrong? Thanks. > I'm currently implementing such a thing (interactive shell / compiled scripts (only the former of which is currently being implemented)). LLVM apparently has one problem regarding this: Its context caches all constants ever created and doesn't free them, until the LLVMContext object is free'ed itself. So if your shell for example is connected to a pipe, accepting generated scripts or something in possibly fast succession, you will have problems with inputs such as: print 0 # 0 is cached and never free'ed print 1 # 1...

Hi devs, We are implementing a library that interprets shell scripts so that other programs could efficiently talk to bash. We'd like to hear your advice on whether LLVM is appropriate for us. Here are our considerations: In most cases our library will interpret each script just once. Our current approach is using a manual implementation based on ANTLR and C++, so actually we are executing

Hi Kevin, On April 11, 2017 at 4:14:14 PM, Flamedoge (code.kchoi at gmail.com) wrote: > So only "non-freed" malloc pointers are No-Alias which makes it > flow-sensitive. There is no reason why malloc couldn't return previously > freed location. Yes. Talking to Nick Lewycky on IRC, I figured out a shorter way of saying what I wanted to say.  We know that programs like this are UB in C:...

From: Colin Ian King <colin.king at canonical.com> The default sensor->type case leaks memory allocated to rail. Fix this by free'ing rail before we continue with the next loop iteration. Signed-off-by: Colin Ian King <colin.king at canonical.com> --- drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c b/drivers...

...e invalidated and stop holding the dangling pointers, but it > > just seems weird. Thankfully, ASan can generally catch problems if we do > > try to access through any of these dangling pointers. > > But asan won't catch problems (insofar I understand how it works) if > the free'ed BasicBlock is used as a key in a DenseMap or something -- > if another BasicBlock gets allocated to the same location we'll end up > returning bad cached results. > ASan's allocator is specifically hardened against reusing memory, which mitigates this, but I'm not sure...

...at the above sources, it looks like the device_path is configured twice: 509 device_path = xstrdup("auto"); /*getenv ("HAL_PROP_HIDDEV_DEVICE"); */ 626 device_path = xstrdup(argv[0]); Other than the fact that we leak a few bytes of memory here by using xstrdup() twice without free'ing in between, I don't think this is what we intended to do. It looks to me that the socket will now be named 'usbhid-ups-usbhid-ups', which would be ugly? Since I don't use HAL, I can't verify this, but I think we really want it to look like 'usbhid-ups-auto'. Bes...

...is pl = hint->open_nearby_postlist(term); Unfortunately, the compiler had optimised a lot of debugging information away. Still, it's clear where the system crashed. Following a similar crash and re-running the query we could not reproduce the crash, but valgrind catched a read-after-free on the `hint` field (full valgrind log attached): ==2265126== Invalid read of size 8 ==2265126== at 0x9A6B313: LocalSubMatch::open_post_list(std::string const&, unsigned int, double, bool, bool, QueryOptimiser*, bool) (localsubmatch.cc:289) which got free'd in this code...

...are instrumented with different asan passes. >From what I have thought of yet (but I'd love feedback!), these changes are needed: 1. Storing+checking thread/plugin id in shadow byte. 2. Modified stack instrumentation to set up these shadow bytes. 3. Graceful shutdown of plugins preferred, free'ing heap and signaling back to main thread instead of shutting down. Also, an optional compile flag could be used to modify the instrumentation's granularity, whether to assume memory blocks are allocated in multiples of 8, giving less code-blowup. The shadow bytes would essentially be...

...at code already and will check if this situation still applies there. 2016-06-02 12:28 GMT+02:00 Colin King <colin.king at canonical.com>: > From: Colin Ian King <colin.king at canonical.com> > > The default sensor->type case leaks memory allocated to rail. Fix > this by free'ing rail before we continue with the next loop iteration. > > Signed-off-by: Colin Ian King <colin.king at canonical.com> > --- > drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/nouveau/nvkm...

...ocess forked to run the shell. Just after the fork, fatal_remove_all_cleanups() is called, which looks like: fatal_remove_all_cleanups(void) { struct fatal_cleanup *cu, *next_cu; for (cu = fatal_cleanups; cu; cu = next_cu) { next_cu = cu->next; xfree(cu); } } It runs through free'ing the structs, but it leaves the global fatal_cleanups pointing to the first struct. If called later, fatal_cleanup() attempts to deref the whatever happens to be at that location, falls over, goes boom. -Daz. # gdb -q ./sshd /var/core/core.sshd.2...

...ntl waf configure check. * BUG 14602: s3/auth: Implement "winbind:ignore domains". * BUG 14617: smbd: Use fsp->conn->session_info for the initial delete-on-close token. o Peter Eriksson <pen at lysator.liu.se> * BUG 14648: s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path. o Bj?rn Jacke <bj at sernet.de> * BUG 14624: classicupgrade: Treat old never expires value right. o Volker Lendecke <vl at samba.org> * BUG 14636: g_lock: Fix uninitalized variable reads. o Stefan Metzmacher <metze at samba.org> * BUG 1389...

...ntl waf configure check. * BUG 14602: s3/auth: Implement "winbind:ignore domains". * BUG 14617: smbd: Use fsp->conn->session_info for the initial delete-on-close token. o Peter Eriksson <pen at lysator.liu.se> * BUG 14648: s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path. o Bj?rn Jacke <bj at sernet.de> * BUG 14624: classicupgrade: Treat old never expires value right. o Volker Lendecke <vl at samba.org> * BUG 14636: g_lock: Fix uninitalized variable reads. o Stefan Metzmacher <metze at samba.org> * BUG 1389...

While building test-suite with the new PM, I ran into problems with AssertingVH being triggered which is obvious in retrospect: https://llvm.org/bugs/show_bug.cgi?id=28400 Both cases I ran into revolve around LVI which holds AssertingVH. Essentially, what happens is this: 1. LVI holds an AssertingVH pointing at a BasicBlock 2. Some other pass ends up deleting that BB (e.g. SimplifyCFG) 3. BOOM

...of conditions". Which makes it even worse because they become aliasing again. On Tue, Apr 11, 2017 at 5:09 PM, Flamedoge via llvm-dev < llvm-dev at lists.llvm.org> wrote: > I don't know when this was added on cppreference but > > > The behavior is undefined if after free() returns, an access is made > through the pointer ptr (unless another allocation function happened to > result in a pointer value equal to ptr) > > This seems to suggest that there is no UB... However, I couldn't find the > corresponding line or relevant part on latest C std, &g...

...strumented. > > > From what I have thought of yet (but I'd love feedback!), these changes > are needed: > > 1. Storing+checking thread/plugin id in shadow byte. > 2. Modified stack instrumentation to set up these shadow bytes. > 3. Graceful shutdown of plugins preferred, free'ing heap and signaling > back to main thread instead of shutting down. > > Also, an optional compile flag could be used to modify the > instrumentation's granularity, whether to assume memory blocks are > allocated in multiples of 8, giving less code-blowup. The shadow byt...

The following patch attempts to make the source client user agent and the max listener client connection duration information available to (icecast 2.3.2) xsl stylesheets. Will there be any memory leak issues in the lower level functions like the acl, etc. when the source is disconnected, when servicing queries, or otherwise? BEGIN icecast-2.3.2-moremntinfo.patch diff --git src/source.c

Hi, the two patches improve the way memory is handled in supermin, by cleanly exiting on memory allocation failures, and free'ing memory when not needed (to keep working and not run out of memory). Pino Toscano (2): Check for failures in memory allocations Free memory buffers when not used src/ext2fs-c.c | 13 +++++++++++-- src/init.c | 13 +++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) -...

On Mon, Jul 11, 2016 at 11:17 PM, Sanjoy Das <sanjoy at playingwithpointers.com > wrote: > Hi Sean, > > Sean Silva wrote: > > > > But asan won't catch problems (insofar I understand how it works) if > > the free'ed BasicBlock is used as a key in a DenseMap or something -- > > if another BasicBlock gets allocated to the same location we'll end > up > > returning bad cached results. > > > > > > ASan's allocator is specifically hardened against reusing memo...

Hi all, I think I've spotted a semantic issue with marking @malloc and @realloc as noalias.  Say we have the program: int f() {   int* p0 = malloc(size of(int));   free(p0);   int* p1 = malloc(sizeof(int));   if (!p1) return 20;   int value = 0;   for (int i = 0; i < 1; i++) {     *p1 = 20;     value = *p1;     if (false)  // "false" is obscured in a way the compiler can't fathom       if (p0 == p1)         a();       else         b();   }   retur...