Bug 137533

Summary: *** glibc detected *** double free or corruption: 0x000000000079d4e5
Product: [Fedora] Fedora Reporter: Tim Waugh <twaugh>
Component: anacondaAssignee: Anaconda Maintenance Team <anaconda-maint-list>
Status: CLOSED NEXTRELEASE QA Contact: Mike McLean <mikem>
Severity: high Docs Contact:
Priority: medium    
Version: rawhideCC: drepper, nobody+pnasrat, sjhallow-myoss, wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-06-21 13:09:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 130887    
Attachments:
Description Flags
ks-auto.cfg
none
anaconda-free.patch none

Description Tim Waugh 2004-10-29 11:11:51 UTC 
Description of problem:
I get this message from a kickstart install (from HD) of FC3 rc2:

*** glibc detected *** double free or corruption: 0x000000000079d4e5

Then the installation aborts.  VT3 says:

[...]
* Found hd stage2
* Copying /tmp/loopimage//Fedora/base/stage2.img in RAM as stage 2
* copied 77369344 bytes to /tmp/ramfs/stage2.img (complete)
* mntloop loop1 on /mnt/runtime as /tmp/ramfs/stage2.img fd is 14
* umounting loopback /tmp/loopimage loop0

Version-Release number of selected component (if applicable):
anaconda-10.1.0.2-1.x86_64.rpm

How reproducible:
100%

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Tim Waugh 2004-10-29 14:01:34 UTC 
Also happens with FC3-3.4.
Comment 2 Tim Waugh 2004-10-29 14:41:08 UTC 
Created attachment 105939 [details]
ks-auto.cfg

Here is the kickstart file I'm using.
Comment 4 Tim Waugh 2004-11-01 10:58:50 UTC 
Same happens with RC5, except the address is 0x79d565.

Can anyone else reproduce this, or is it just me?
Comment 5 Tim Waugh 2004-11-02 11:16:37 UTC 
Hmm, I might have found the problem -- testing a fix.
Comment 6 Tim Waugh 2004-11-02 11:22:47 UTC 
Created attachment 106064 [details]
anaconda-free.patch

Here is the fix.  We are passing ptr+5 to free() instead of ptr.
Comment 7 Tim Waugh 2004-11-02 11:58:48 UTC 
I've checked in this fix to HEAD and to fc3-branch.
Comment 8 Jeremy Katz 2004-11-02 14:32:24 UTC 
Thanks Tim.  Probably won't get into FC3 unless we do a respin at this
point (workaround is to remove /dev from your device name)
Comment 9 Jeremy Katz 2004-11-16 17:09:25 UTC 
*** Bug 139488 has been marked as a duplicate of this bug. ***