From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <4C19037D.6030301@domain.hid>
Date: Wed, 16 Jun 2010 19:01:49 +0200
From: Daniele Nicolodi <daniele@domain.hid>
MIME-Version: 1.0
References: <4B992463.8050202@domain.hid>
In-Reply-To: <4B992463.8050202@domain.hid>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Xenomai-core] Analogy a4l_fill_desc() bug
List-Id: Xenomai life and development <xenomai.xenomai.org>
List-Unsubscribe: <https://mail.gna.org/listinfo/xenomai-core>,
	<mailto:xenomai-core-request@domain.hid>
List-Archive: </public/xenomai-core>
List-Post: <mailto:xenomai@xenomai.org>
List-Help: <mailto:xenomai-core-request@domain.hid>
List-Subscribe: <https://mail.gna.org/listinfo/xenomai-core>,
	<mailto:xenomai-core-request@domain.hid>
To: xenomai@xenomai.org

On 11/03/10 18:12, Daniele Nicolodi wrote:
> Hello.
> 
> I found a bug in a4l_fill_desc(). If I call it on a descriptor obtained
> for an unattached device, the memory allocated for the sbdata descriptor
> field is corrupted in a bad way. When, after the failing a4l_fill_desc()
> call, I free() it, glibc complains about an "invalid next size" for the
> memory chunk.
> 
> I'm on x86 architecture using kernel 2.6.30.10 with xenomai 2.5.1.

This bug is still biting me...

Cheers,
-- 
Daniele