Re: [MiNT] windom and gcc4

[Miro Kropacek <miro.kropacek@gmail.com>]

What if ldg points to something in the freed area?
Maybe ldg itself is the pointer the the Malloc'd area.
Maybe baspag is the first member of the struct.
In which case ldg and ldg->baspag point to the same address :-)

This is how it works (short version):

LDG* ldg = NULL;
BASPAG* module = NULL;
char offsetxt[24];
sprintf(offsetxt,"OFFSETLDG=%ld%c%c",(long)&ldg,'\0','\0');

module = (BASPAG *)Pexec( 3, path, NULL, offsetxt);
Pexec( 4, NULL, module, NULL);
ldg -> baspag = module

so, we pass pointer to LDG* to ldg module which should be loaded... second Pexec executes this code (between those two Pexec's is some code but unrelated to our problem), i.e. our NULL value in 'ldg' becomes some address as the part of executions is allocation of memory and storing the pointer to the given address.

Next, Compendium says parent process (caller) should free env and basepage space when exit, what is our code:

 if( ldg->close) (*ldg->close)();
        Mfree( ((BASPAG *)ldg->baspag)->p_env);
        Mfree( ldg->baspag);
        ldg->baspag = NULL;

as far as I understood, ldg->close() does nothing (it went down to libshare and there was empty body) and then we see what's next: freeing memory allocated by OS so this must be OK.

I think the only place (except some obscure situation) where the bug may be is the allocation routine inside ldg module -- but I didn't take a deep look yet.


-- 
MiKRO / Mystic Bytes
http://mikro.atari.org