piewm: (malloc) Corrupted redzone 1 byte after 0xa00cbe0 (size 41) (0x0)

[David Wolfskill]

>Submitter-Id:	current-users
>Originator:	David Wolfskill
>Organization:	Wolfskill & Dowling Residence
>Confidential:	no
>Synopsis:	piewm: (malloc) Corrupted redzone 1 byte after 0xa00cbe0 (size 41) (0x0)
>Severity:	serious
>Priority:	high
>Category:	ports
>Class:		sw-bug
>Release:	FreeBSD 7.0-CURRENT i386
>Environment:
System: FreeBSD g1-18.catwhisker.org. 7.0-CURRENT FreeBSD 7.0-CURRENT #18: Sat Mar 11 11:14:00 PST 2006     root at g1-18.catwhisker.org.:/common/S1/obj/usr/src/sys/LAPTOP_30W  i386

Above is where the problem symptoms were noticed, thanks to jemalloc.
I believe the problem has actually existed for a very long time.

>Description:
piewm uses m4 in parsing its configuration file.  Before it does so, it
creates a temporary file of definitions.  It does this in the MkDef()
function in parse.c.

In creating the definition lines, it tries to only allocate as much
memory as necessary.

However, there is an off-by-one error; I believe that when the
routine was coded the trailing NUL character for the strings in
question was overlooked.  (There is code to "pad" the allocation
for known "extra" characters that will be needed.  It's just a
little smaller than it needs to be.)

By default, FreeBSD 7-CURRENT (as of this time) has code enabled to
identify "red zone corruption;" in this case, it's a matter of an
attempt to write on storage that was not allocated.

One symptom is the message:
piewm: (malloc) Corrupted redzone 1 byte after 0xa00cbe0 (size 41) (0x0)

Another is that the window manager is not, in fact, functional.

It would be extremely cool if we could get this simple fix in before
the ports tree is completely frozen for the 6.1 release.

And my thanks to Jason for providing the hints for me to be able to
finally(!) track this bug down and squash it.

And I am presently using the patched version; it does work.

>How-To-Repeat:
Install ports/x11-wm/piewm, then run it.

>Fix:

--- parse.c.port	Sat Mar 11 16:06:49 2006
+++ parse.c	Sat Mar 11 16:08:22 2006
@@ -1389,7 +1389,7 @@
 /* Code taken and munged from xrdb.c */
 #define MAXHOSTNAME 255
 #define Resolution(pixels, mm)	((((pixels) * 100000 / (mm)) + 50) / 100)
-#define EXTRA	11
+#define EXTRA	12
 
 static char *
 MkDef(char *name, const char *def)