All,

Apparently the header of a heap item is a data structure we’re not supposed to 
know what it is like, but some seem (or mean) to know. Apparently, this is also 
different for QDOS and SMSQ/E:

The QDOS Technical guide describes the heap item header a bit differently:

"Each heap item is an area of memory (which is a multiple of 8 bytes long), 
together with a pair of longwords: the first is the length of the heap item, 
while the second is a pointer (relative to itself) to the next heap item in the 
list. The use of relative pointers ensures that heaps may be moved. „

That would look like
        ds.l    hp_len          ; length of heap item
        ds.l    hp_nxfree       ; next free item in free list (relative pointer)
hpi:  ds.b heap_data

So, in your case, -4(a) would point to the next free heap item in the free 
list. As the free list entry is not used for /allocated/ heap chunks (only on 
those that are worked into a free list), Mr. Goodwin is free to use it for some 
other purpose - On QDOS. Apparently, on SMSQ/E -4(ax) points to something 
different, and thus looks weird to be changed by applications.
Thus, this code is a good example of why you shouldn’t use undocumented data 
structures: They might change over time :)

Regards,
Tobias


> Am 23.01.2016 um 07:41 schrieb Wolf <[email protected]>:
> 
> Hi,
> 
> I don't quite agree with Per's explanation, at least not as far as SMSQ/E is 
> concerned.
> 
> Once the memory is allocated, A0 points past the header, as Per said.
> 
> So, at -4(a0) you will find chp_flag, not chp_len.
> 
> Moreover, chp_flag is used by the system :
> 
> Consider how SMSQ/E releases memory reserved on the common heap
> (in smsq_mem_rchp_asm)
> 
>        movem.l reglist,-(sp)           save volatiles
>        moveq   #chp.free,d0
>        move.l  d0,chp_ownr(a0)         set owner free
>        move.l  chp_flag(a0),d0         flag address
>        beq.s   mrc_rehp               is empty, do nothing
>        move.l  d0,a1                   set flag...
>        st      (a1)                   ...now
> *
> So what happens here is that, if chp_flag isn't empty, the address
> it points to will have its MSB set. If you put "grab" in there, then address 
> $67726162 will have its MSB set to 1.
> 
> OK, that most likely won't be a problem because in most cases that address 
> doesn't exist. But what if you put something else than "grab" at chp_flag and 
> that points to somewhere in real memory? Oops...
> 
> So your initial way of doing things definitely is the right way.
> 
> 
> HTH
> 
> Wolfgang
> 
> _______________________________________________
> QL-Users Mailing List

_______________________________________________
QL-Users Mailing List

Reply via email to