|
From: Daniel J S. <dan...@ie...> - 2007-04-09 03:55:05
|
Ethan A Merritt wrote:
> I think you are missing the worrisome point. The routine cp_free() works
> its way through a linked list of plots, freeing all dynamically allocated
> space as it goes. The comment warns that this may fail if there was a call
> to int_error() while one of those dynamically allocated plot structures
> was in the process of being filled in. That would hypothetically leave
> invalid links in the linked list, or struct entries that are supposedly
> pointers but contain random garbage. This really shouldn't happen if
> everything is initialized in the correct order, but the comment suggests
> that may not be the case.
Oh, that explains what "first_plot" means. Also, the "first_plot" is a global.
Inside set.c is some strange code. It doesn't appear to be a bug but I don't
understand why the f_p and f_3dp had to be used. Is there a chance cp_free()
and sp_free() might fail? If so, the routines shouldn't do that:
else {
struct curve_points *f_p = first_plot;
struct surface_points *f_3dp = first_3dplot;
first_plot = NULL;
first_3dplot = NULL;
cp_free(f_p);
sp_free(f_3dp);
iso_samples_1 = tsamp1;
iso_samples_2 = tsamp2;
}
Anyway, what I sent last time still applies but at a narrower scope. For example:
if (*tp_ptr)
this_plot = *tp_ptr;
else { /* no memory malloc()'d there yet */
this_plot = cp_alloc(MIN_CRV_POINTS);
*tp_ptr = this_plot;
}
"this_plot" shouldn't be moved into the list until after a success. I.e., move
the line *tp_ptr = this_plot to the end of the routine. E.g. (?)
if (this_plot)
cp_free(this_plot);
if (*tp_ptr)
this_plot = *tp_ptr;
*tp_ptr = NULL;
else { /* no memory malloc()'d there yet */
this_plot = cp_alloc(MIN_CRV_POINTS);
}
[snip]
*tp_ptr = this_plot;
This is a bit messy. (Little linked-list maintenance routines are always good.)
But see what you can do.
Dan
|