[SOLVED] best approach to debug "corrupted double-linked list" crash

Issue

I am in the process of debugging a "corrupted double-linked list" crash. I have seen the source and understand the chunk struct and the fd/bk pointers, etc, so I think I know why this crash has occurred. I am now trying to fix it and I have a couple of questions.

Question #1: where (with respect to the pointer returned from malloc) is the malloc_chunks struct maintained? Are they before the memory block or after it?

Question #2: the malloc_chunks for allocated memory are different from the malloc_chunks for unallocated memory. It appears (??) that the allocated buffer case does not have the fd/bk pointers. Is this correct?

Question #3: what is the recommended approach to debug this type of error? I am assuming that I should put a break point for the malloc_chunks so I can break on when the struct is overwritten. But I am not sure how to access those malloc structs so I can set a break point in gdb.

Any suggestions on how to proceed would be very appreciated.

Thanks, -Andres

Solution

what is the recommended approach to debug this type of error?

The usual way is not to peek into GLIBC internals, but to use a tool like Valgrind or AddressSanitizer, either of which is likely to point you straight at the problem.

Update:

Valgrind crashes ...

You should try building the latest Valgrind version from source, and if that still crashes, report the crash to Valgrind developers.

Chances are the Valgrind problem is already fixed, and building new Valgrind and testing your program with it will still be faster than trying to debug GLIBC internals (heap corruption bugs are notoriously difficult to find by program inspection or debugging).

AddressSanitizer, I thought it was a clang only tool -- I do not think it is available for linux.

Two points:

1. Clang works just fine on Linux, I use it almost every day,
2. Recent GCC versions have an equivalent -fsanitize=address option.

Answered By - Employed Russian