On Sunday 16 August 2026 11:54:57 Kirill Makurin wrote: > Pali Rohár <[email protected]> wrote: > > > The test t_tsearch.c is crashing on Windows XP. Function twalk() invokes > > twalk() in infinite recursion which cause stack overflow. > > > > The reason is that tdestroy() frees the memory for the root node which > > invalidates root pointer and accessing it later cause use-after-free error. > > Seems that msvcrt memory allocator on Windows XP can trigger this crash > > more often than on other Windows versions. > > > > Fix this issue, after the tdestroy() call, sets the root node pointer to > > NULL. > > In testcases changes back in June, I added this comment at the top of > t_tsearch.c: > > ``` > /** > * FIXME: calling `twalk` after `tdestroy` walks the tree as if tree was not > * destroyed. That is, it dereferences freed nodes. > */ > ```
Ou, I should have read comments before investigating why it is crashing... > > From my understanding, function `tdestroy` is a GNU extension and not POSIX. > I have a feeling that it should be responsible for setting the root node to > `NULL`, so that `twalk` will not walk freed nodes. > > - Kirill Makurin That is not possible because tdestroy has API: void tdestroy(void *root, void (*free_node)(void *nodep)); Function is not taking pointer to variable, but the variable itself. So the function itself cannot set the caller's variable to NULL. _______________________________________________ Mingw-w64-public mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mingw-w64-public
