Re: free'd address still readable?

From: Vinay Kurien (vinayik_at_charter.net)
Date: 04/07/04


Date: Wed, 7 Apr 2004 09:09:02 -0500


"Paul Pluzhnikov" <ppluzhnikov-nsp@charter.net> wrote in message
news:m3isgcmj0j.fsf@salmon.parasoft.com...
> "Vinay Kurien" <vinayik@charter.net> writes:
>
> > In a process, if I allocate (using malloc()) an object I get an address.
I
> > am assuming this is a virtual address that the kernel maps to physical
> > memory. My question is, is that virtual address always 'readable' within
> > that process ?
>
> Not necessarily. While most malloc()s do not return any memory they
> obtained from the OS, the malloc in glibc does (under certain
> conditions). If you try to read such address, you'll get a SIGSEGV.
>
> > Even if that object is free'd ?
>
> If the object isn't free()d, the address will be valid.
> If it is, you can't assume anything.

But even if it is free'd, isn't that address just an index into somwhere
the available process heap ? Why is it not readable ? Is this behavior
dependant on the platform ?

I guess it comes down to something as simple as:
//Every time I allocate 'struct something' I set a unique key
struct something *a = (struct something*)malloc(10);
a->key = 0xAABBCCDD;

//Everytime I free 'struct something', I memset it.
free(a);
memset(a, 0, sizeof(struct something);

<snip>
if (a->key != 0xAABBCCDD) { //Is this legal ?
    //object instance is free'd
    return;
}

will this SIGSEGV ?

In my scenario the only difference is that I send the address in a, to
another
process, which that process echos back at a later time. At that later time,
all
I want to know is if that adress still stores an instance of 'struct
something' ... If not, I exit.

>
> > My issue is that, I pass around the context(virtual address) of that
object
> > to other processes and when the context is returned to the process that
> > allocated the object I am not sure if that object has been free'd or
not. Is
>
> Huh? You can't pass pointers to memory allocated in one process to
> another -- the address will not be valid in the other process.

I donot want the other process to try and dereference this memory. I just
want it to echo back the address to the process that allocated this object.

-Vinay

> > If I can read it, I can compare it to some unique number and know if
that
> > memory still holds an instance of the object.
>
> No, you can't: what if the first N bytes of that memory have not
> been touched, but the rest of it has been zero-ed out? Does it
> still hold your instance?
>
> Reading dangling memory results in undefined behavior; just don't
> do it.
>
> Cheers,
> --
> In order to understand recursion you must first understand recursion.
> Remove /-nsp/ for email.



Relevant Pages

  • Re: [PATCH 10 of 20] ipath - support for userspace apps using core driver
    ... The memory that we allocate with dma_alloc_coherent is indeed being ... char device's release method is called. ... so I conclude that the struct pages are leaking. ...
    (Linux-Kernel)
  • [1/2] [NET] link_watch: Move link watch list into net_device
    ... My memory is failing me:) ... makes sense to allocate some memory for it in net_device rather ... somewhat magnified) without singleevent but it's now plugged ... static unsigned char default_operstate(const struct net_device *dev) ...
    (Linux-Kernel)
  • [PATCH 2/6] memcg: allocate page_cgroup at boot (hunk fix)
    ... Allocate all page_cgroup at boot and remove page_cgroup poitner ... from struct page. ... Remove page_cgroup pointer reduces the amount of memory by ...
    (Linux-Kernel)
  • Re: structs
    ... >> and i want to allocate it memory, should i allocate enough to hold the ... > For an instance of the struct, ... > of memory to hold both the struct instance and the stuff ...
    (comp.lang.c)
  • Re: Memory ownership, parameters, variants, etc.
    ... VARIANT you pass in, and any data it refers to, is serialized ... into a memory buffer and transferred over to the callee. ... > struct, but VariantClear will free the content of the struct by ... is no convention on how to allocate and free this memory uniformly, ...
    (microsoft.public.win32.programmer.ole)