Crash with alloca function but ok with malloc

Question

Please explain me reason of crash. I have 3rd party code which unexpectedly crashes with EXC_BAD_ACCESS

static int overwrite_selector(struct srm_target *srm, MARFileRemoverProgressBlock progressBlock)
{
    srm->buffer = (unsigned char *)alloca(srm->buffer_size);

    if(overwrite_byte(srm, 1, 0xF6, progressBlock) < 0) return -1;
    return 0;
}

static int overwrite_byte(struct srm_target *srm, const int pass, const int byte, MARFileRemoverProgressBlock progressBlock)
{
  memset(srm->buffer, byte, srm->buffer_size);
  return overwrite(srm, pass, progressBlock);
}

Crash occurs on line memset(srm->buffer, byte, srm->buffer_size); So seems problem with allocation memory for srm->buffer. But if I replace alloca to malloc then all is ok (no crash).

I develop on osx 10.9 ARC enabled

I noticed bit Apple specific: crash occurs if I run code in global queue but if on main queue all is ok.

Buffer 1048576 bytes. Code was written on C but for some reason I compile it with Objective C rules on Apple LLVM 5.1 compiler. — toohtik, Mar 27 '14 at 16:21
@chux the behavior is undefined on stack overflow so I don't you can rely on that. — Shafik Yaghmour, Mar 27 '14 at 16:32

score 3 · Accepted Answer · edited May 23 '17 at 11:51

3

Sounds like a stack overflow, alloca will allocate from the stack and so if you attempt to allocate too much that will result in a stack overflow while malloc will allocate from the heap which is much larger. There is no way to know when you overflow the stack with alloca.

Also, note that since alloca allocates on the stack returning that memory from the function won't work since that memory will no longer be available once you exit the function. So if you need to use the memory outside the function you will need to use malloc.

edited May 23 '17 at 11:51

Community

1
1

answered Mar 27 '14 at 16:19

Shafik Yaghmour

154,301
39
440
740

Buffer is 10mb is too large for stack? – toohtik Mar 27 '14 at 16:25
10mb: 10 milli-bytes should be small, but 10 mega-bytes sounds like a bit much. :-) – chux - Reinstate Monica Mar 27 '14 at 16:27
2

@toohtik 10 mega bytes is way too [1 to 2 megabytes](http://stackoverflow.com/questions/20234048/stack-overflow-error-in-c-program/20234082#20234082) is a typical default stack size. – Shafik Yaghmour Mar 27 '14 at 16:28
@chux, ten millibits :) – chris Mar 27 '14 at 17:28
@chris [(b)its, (B)ytes, Stacks, Hash, how many are going to cause the Crash?](http://en.wikipedia.org/wiki/As_I_was_going_to_St_Ives) – chux - Reinstate Monica Mar 27 '14 at 17:45

LearningC · Answer 2 · 2014-03-27T16:55:18.840

3

here you allocate memory in function,

static int overwrite_selector(struct srm_target *srm, MARFileRemoverProgressBlock progressBlock)
{
    srm->buffer = (unsigned char *)alloca(srm->buffer_size);

    if(overwrite_byte(srm, 1, 0xF6, progressBlock) < 0) return -1;
    return 0;
}

and since you use alloca, the memory allocated will be freed when the function returns. there for when you use it from other function it results in program to crash.
Here you called other function within the function allocating memory. so the reason seems to be stackoverflow. and there is no way to know this condition from alloca. because of this undefined behaviour of alloca on stackoverflow, it is told that its not good to use alloca in such situations.

edited Mar 27 '14 at 16:55

answered Mar 27 '14 at 16:26

LearningC

3,182
1
12
19

2

You mean that overwrite_byte release memory which was allocated in overwrite_selector? As I understand memory allocated in overwrite_selector should be freed when overwrite_selector return. But carsh in overwrite_byte which inside overwrite_selector therefore memory don't freed. – toohtik Mar 27 '14 at 16:30
1

@toohtik ya right. you called function within that function so memory will not be freed. so this is not the problem – LearningC Mar 27 '14 at 16:40

score 2 · Answer 3 · answered Mar 27 '14 at 17:21

Since alloca attempts to allocate bytes on the stack, it's important to know what the stack size is. You can check the limits on the stack size with code like this

#include <sys/resource.h>

void checkStackSize( void )
{
    struct rlimit limits;

    if ( getrlimit( RLIMIT_STACK, &limits ) == 0 )
        printf( "soft_limit=%lld hard_limit=%lld\n", limits.rlim_cur, limits.rlim_max );
}

When I tested on osx, the soft limit was 8MB and the hard limit was 64MB. On an iOS device, both limits were 1MB.

Note: the following comes from the man page for alloca

alloca() is machine and compiler dependent; its use is discouraged.

alloca() is slightly unsafe because it cannot ensure that the pointer returned points to a valid and usable block of memory. The allocation made may exceed the bounds of the stack, or even go further into other objects in memory, and alloca() cannot determine such an error. Avoid alloca() with large unbounded allocations.

Crash with alloca function but ok with malloc

3 Answers3

Linked