From owner-freebsd-hackers  Fri Oct  3 11:03:40 1997
Return-Path: <owner-freebsd-hackers>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id LAA01875
          for hackers-outgoing; Fri, 3 Oct 1997 11:03:40 -0700 (PDT)
Received: from elvis.vnet.net (elvis.vnet.net [166.82.1.5])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id LAA01869
          for <hackers@FreeBSD.ORG>; Fri, 3 Oct 1997 11:03:30 -0700 (PDT)
Received: from ponds.dignus.com (ponds.vnet.net [166.82.177.48])
          by elvis.vnet.net (8.8.5/8.8.4) with ESMTP
	  id OAA18176; Fri, 3 Oct 1997 14:02:16 -0400 (EDT)
Received: from lakes.dignus.com (lakes [10.0.0.3])
	by ponds.dignus.com (8.8.5/8.8.5) with ESMTP id OAA11356;
	Fri, 3 Oct 1997 14:17:19 -0400 (EDT)
Received: (from rivers@localhost) by lakes.dignus.com (8.8.5/8.6.9) id OAA16774; Fri, 3 Oct 1997 14:08:12 -0400 (EDT)
Date: Fri, 3 Oct 1997 14:08:12 -0400 (EDT)
From: Thomas David Rivers <rivers@dignus.com>
Message-Id: <199710031808.OAA16774@lakes.dignus.com>
To: nate@mt.sri.com, phk@critter.freebsd.dk
Subject: Re: Bug in malloc/free (was: Memory leak in getservbyXXX?)
Cc: gram@cdsec.com, hackers@FreeBSD.ORG
Sender: owner-freebsd-hackers@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> In message <199709181912.NAA13699@rocky.mt.sri.com>, Nate Williams writes:
> 
> >[ 'hangs' in malloc due to memory over-write causing circular lists ]
> >
> >> >> This is about the only way you could get it to loop I think.  That means
> >> >> that somebody wrote to memory malloc hadn't passed them (ie: your code).
> >> >
> >> >Yikes, this would be 'Hard to Do', even by design (ie; self-modifying
> >> >code).  But, stranger things have happened, especially with dealing with
> >> >malloc/free.
> >> 
> >> No, all you have to do is to make each allocation have it's own set of
> >> pages, munmap them when free is called and never use those pages again.
> >> 
> >> You run out of address space really fast, and it is slow, but it works.
> >
> >It's slow, but how would it cause malloc to hang?
> 
> It wouldn't, it would detect accesses to free'ed memory.
> 

Sorry to reply so late for this - I'm just now getting to it...

Anyway; such a package already exists, and runs on FreeBSD.

It's called Electric Fence.

I'd be happy to send anyone the information & source...

	- Dave Rivers -