From nobody@FreeBSD.ORG  Sat Aug 26 06:55:40 2000
Return-Path: <nobody@FreeBSD.ORG>
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id E62AD37B424; Sat, 26 Aug 2000 06:55:40 -0700 (PDT)
Message-Id: <20000826135540.E62AD37B424@hub.freebsd.org>
Date: Sat, 26 Aug 2000 06:55:40 -0700 (PDT)
From: jml@cubical.fi
Sender: nobody@FreeBSD.ORG
To: freebsd-gnats-submit@FreeBSD.org
Subject: malloc() generates SIGSEGV
X-Send-Pr-Version: www-1.0

>Number:         20862
>Category:       misc
>Synopsis:       malloc() generates SIGSEGV
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    phk
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Aug 26 07:00:00 PDT 2000
>Closed-Date:    Sat Sep 16 12:55:46 PDT 2000
>Last-Modified:  Sat Sep 16 12:56:23 PDT 2000
>Originator:     Juha Liukkonen
>Release:        4.1-RELEASE
>Organization:
Cubical Solutions Ltd
>Environment:
FreeBSD skitso.intra.net 4.1-RELEASE FreeBSD 4.1-RELEASE #0: Sat Aug 19 14:56:42 EEST 2000
     root@skitso.intra.net:/usr/src/sys/compile/server-mp.conf  i386

>Description:
malloc() says "recursive call" and gives a SIGSEGV when called with a
nasty size value (0xffff0000..0xfffefff qualify). The
wraparound check added with kern/2964 was apparently not sufficient :-)

>How-To-Repeat:
void *foo = malloc(0xffff0000);
>Fix:


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->phk 
Responsible-Changed-By: sheldonh 
Responsible-Changed-When: Mon Aug 28 02:58:03 PDT 2000 
Responsible-Changed-Why:  
Poul-Henning closed kern/2964. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=20862 
State-Changed-From-To: open->closed 
State-Changed-By: phk 
State-Changed-When: Sat Sep 16 12:55:46 PDT 2000 
State-Changed-Why:  
I cannot reproduce this.  Are you sure you don't have a signal handler 
or something which directly or indirectly calls malloc ? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=20862 
>Unformatted:
