In `duma.c`, the code that follows the comment "I get here if I haven't been able to find a free buffer..." only attempts to allocate `chunkSize` bytes of memory. This means that, executing this block of code, if `userSize` is greater than `chunkSize` (i.e. the user attempts to allocate more than `DUMA_PAGE_SIZE` bytes), only `chunkSize` bytes are allocated, but the call to `_duma_init_slack` later on attempts to write to `userSize` bytes.
See https://sourceforge.net/tracker/?func=detail&aid=2923807&group_id=149725&atid=775378 for patches.
View and moderate all "bugs Discussion" comments posted by this user
Mark all as spam, and block user from posting to "Bugs"
Fixed under debian thank