Bug 184384 - setlocale() calls free(NULL)
Summary: setlocale() calls free(NULL)
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: glibc
Version: 3.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Jakub Jelinek
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-03-08 13:18 UTC by Toralf
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-03-11 20:18:22 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Test program (77 bytes, text/plain)
2006-03-08 13:18 UTC, Toralf
no flags Details

Description Toralf 2006-03-08 13:18:13 UTC
Description of problem:
setlocale() will under certain contions call free(NULL). This is not exactly a
bug in its own right, but it could indicate an unexpected state inside the
routine, and having such calls floating around makes it harder to track down
actual memory errors and leaks in a program.

Version-Release number of selected component (if applicable):
glibc-2.3.2-95.37

How reproducible:
Every time

Steps to Reproduce:
1. cc setlocale.c -ldmalloc -o setlocale
2. DMALLOC_OPTIONS=debug=0x2000000 ./setlocale

(Assuming dmalloc is installed. setlocale.c will be attached to this report.)
  
Actual results:
1141823485: 30: WARNING: tried to free(0) from 'ra=0xe9cdbf'
1141823485: 30: free: invalid pointer: from 'ra=0xe9cdbf'
1141823485: 30: ERROR: _chunk_free: pointer is null (err 20)
1141823485: 30: ending time = 1141823485, elapsed since start = 0:00:00


Expected results:
[ No output ]

Additional info:
I'm testing under RHEL 3 right now, but I've also seen it on other releases and
libc versions.

Part of the problem is that various functions in Gtk and Glib contain
setlocale() calls that trigger this problem.

Comment 1 Toralf 2006-03-08 13:18:13 UTC
Created attachment 125795 [details]
Test program

Comment 2 Toralf 2006-03-08 13:55:51 UTC
Note that we've run extensive tests of the type indicated above, and this is the
only instance of free(NULL) within the system libs encountered so far. This
suggests to me that the developers have generally tried to avoid freeing
NULL-pointers, which probably also means it was not done on purpose in this case.

Comment 3 Jakub Jelinek 2006-03-11 20:18:22 UTC
I don't see how the tests could be extensive, there are hundreds of places
in glibc alone where free can be called with NULL and in all cases it relies
on the ISO C99 7.20.3.2 mandated behavior of free - if ptr is a null pointer,
no action occurs.


Note You need to log in before you can comment on or make changes to this bug.