incorrect list handling in copy_small_ranges

Open Beginner friendly
#102 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
operating-systems

Research direction

Start in src/malloc-graph.c at copy_small_ranges and trace the allocation-failure path after a partially copied list has been built. Verify the failure path cannot retain a link into the original live list, and use the project’s existing test or allocation-failure checks if available to confirm that cleanup does not double-free.

Written by the indexing model from the issue text.

Description

In src/malloc-graph.c, the copy_small_ranges function is defined as:

static bool copy_small_ranges(SmallRange **copy, SmallRange *range) {
    for (; range; range = range->next) {
        *copy = malloc(sizeof(**copy));
        if (!*copy) {
            return false;
        }
        **copy = *range;
        copy = &(*copy)->next;
    }
    return true;
}

If malloc fails during any iteration other than the first:

  • **copy = *range copy-assigns the entire struct, which includes copying the original list's range->next pointer.
  • copy = &(*copy)->next shifts the assignment target to the next pointer of the newly allocated range.
  • When the subsequent malloc fails, the loop exits with false without setting *copy (the next pointer of the prior allocated node) to NULL.
  • The partially copied list remains linked to the original live list starting from range->next.

This behavior leads to double-free corruption.

Dominant language
C
Stars
67
Forks
40
Avg merge
1d 2h
Merged PRs (30d)
12

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Comfy-Org/comfy-aimdo

All issues in Comfy-Org/comfy-aimdo

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.