Pali Rohár <[email protected]> wrote: > The test t_tsearch.c is crashing on Windows XP. Function twalk() invokes > twalk() in infinite recursion which cause stack overflow. > > The reason is that tdestroy() frees the memory for the root node which > invalidates root pointer and accessing it later cause use-after-free error. > Seems that msvcrt memory allocator on Windows XP can trigger this crash > more often than on other Windows versions. > > Fix this issue, after the tdestroy() call, sets the root node pointer to NULL.
In testcases changes back in June, I added this comment at the top of t_tsearch.c: ``` /** * FIXME: calling `twalk` after `tdestroy` walks the tree as if tree was not * destroyed. That is, it dereferences freed nodes. */ ``` >From my understanding, function `tdestroy` is a GNU extension and not POSIX. I >have a feeling that it should be responsible for setting the root node to >`NULL`, so that `twalk` will not walk freed nodes. - Kirill Makurin _______________________________________________ Mingw-w64-public mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mingw-w64-public
