[Mono-bugs] [Bug 64674][Nor] New - negative size byte arrays leak memory when allocated

bugzilla-daemon@bugzilla.ximian.com bugzilla-daemon@bugzilla.ximian.com
Mon, 30 Aug 2004 15:21:02 -0400 (EDT)


Please do not reply to this email- if you want to comment on the bug, go to the
URL shown below and enter your comments there.

Changed by kd.mono@spflrc.org.

http://bugzilla.ximian.com/show_bug.cgi?id=64674

--- shadow/64674	2004-08-30 15:21:02.000000000 -0400
+++ shadow/64674.tmp.7641	2004-08-30 15:21:02.000000000 -0400
@@ -0,0 +1,65 @@
+Bug#: 64674
+Product: Mono: Runtime
+Version: unspecified
+OS: GNU/Linux [Other]
+OS Details: Fedora Core 2, linux 2.6.6-1.435.2.3
+Status: NEW   
+Resolution: 
+Severity: 
+Priority: Normal
+Component: misc
+AssignedTo: mono-bugs@ximian.com                            
+ReportedBy: kd.mono@spflrc.org               
+QAContact: mono-bugs@ximian.com
+TargetMilestone: ---
+URL: 
+Cc: 
+Summary: negative size byte arrays leak memory when allocated
+
+Description of Problem:
+Allocating arrays of negative size leaks memory from mono, eventually
+causing a crash.
+
+Steps to reproduce the problem:
+// created on 8/6/2004 at 6:21 PM
+using System; // exception
+
+namespace foo {
+  public class negarray {
+    public static int Main(string[] argv) {
+      for (int j = 0; j < 100000; j++) {
+        int throws = 0;
+	int okcnt = 0;
+	for (int i = 0; i < 40; i++) {
+	  int sz = 20 - i;
+	  try { 
+	    byte[] ary = new byte[sz];
+	    okcnt++;
+	    ary[0] = 2;
+	  }
+	  catch (Exception) {
+	    throws++;
+	  }
+	} // end i
+      } // end j
+      System.Console.WriteLine("test finished");
+      return 0;		
+    }
+  }
+}
+
+
+Actual Results:
+segmentation fault
+
+Expected Results:
+Reach the end and print out "test finished".  This is the behavior on
+Windows, for the same code.
+
+How often does this happen? 
+Every time.  Change the value of i for different behavior.  e.g. setting i
+to 10000 gives the "Too many heap sections" abort.
+
+Additional Information:
+I would expect that allocating any array of negative size would throw an
+exception, but sometimes mono does not throw, for certain sizes.