Re: [Qemu-devel] [PATCH] Permit zero-sized qemu_malloc() & friends

[Blue Swirl <blauwirbel@gmail.com>]

On Sun, Dec 6, 2009 at 10:39 AM, malc <av1474@comtv.ru> wrote:
> On Sun, 6 Dec 2009, Markus Armbruster wrote:
>
>> malc <av1474@comtv.ru> writes:
>>
>> > On Sat, 5 Dec 2009, Markus Armbruster wrote:
>> >
>> >> Anthony Liguori <anthony@codemonkey.ws> writes:
>> >>
>> >> > Markus Armbruster wrote:
>> >> >> Commit a7d27b53 made zero-sized allocations a fatal error, deviating
>> >> >> from ISO C's malloc() & friends.  Revert that, but take care never to
>> >> >> return a null pointer, like malloc() & friends may do (it's
>> >> >> implementation defined), because that's another source of bugs.
>> >> >>
>> >> >> Rationale: while zero-sized allocations might occasionally be a sign of
>> >> >> something going wrong, they can also be perfectly legitimate.  The
>> >> >> change broke such legitimate uses.  We've found and "fixed" at least one
>> >> >> of them already (commit eb0b64f7, also reverted by this patch), and
>> >> >> another one just popped up: the change broke qcow2 images with virtual
>> >> >> disk size zero, i.e. images that don't hold real data but only VM state
>> >> >> of snapshots.
>> >> >>
>> >> >
>
> [..snip..]
>
>
>> >
>> > P.S. It would be interesting to know how this code behaves under OpenBSD, with
>> >      p = malloc (0);
>> >
>> > [1] As does, in essence, http://www.opengroup.org/onlinepubs/7990989775/xsh/read.html
>>
>> Replace "p = (void *)-1" by "p = NULL" and it works just fine.
>>
>
> That's why i asked for somone to run it on OpenBSD:

$ cat mall.c
#define _GNU_SOURCE
#include <err.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#include <stdio.h>

int main (void)
{
    int fd = open ("/dev/zero", 0);
    int ret;
#if 0
    void *p = (void *) -1;
#else
    void *p = malloc(0);
#endif

    fprintf(stderr, "ptr %p\n", p);
    if (fd == -1) err (1, "open");
    ret = read (fd, p, 0);
    if (ret != 0) err (1, "read");
    return 0;
}
$ gcc mall.c
$ ./a.out
ptr 0x46974060
$

Changing read count to 1:
$ ./a.out
ptr 0x41ce0070
a.out: read: Bad address