|
From: Daniel J S. <dan...@ie...> - 2004-08-16 22:07:48
|
Looking through some code, I see the following line
df_column = (df_column_struct *) gp_realloc(df_column,
(df_max_cols += (df_max_cols < 20 ? 20 :
df_max_cols)) * sizeof(df_column_struct),
"datafile column");
Does anyone else find this suspicious? Particularly the part where
df_max_cols is changed *before* the actual allocation takes place.
Here is a far fetched scenario that might cause a problem. Say someone
runs gnuplot and has a bunch of other programs running. The person
tries a plot and it fails to allocate memory because there is no room.
Gnuplot gives an error in the gp_realloc() function. However,
df_max_cols has already been updated. The person then thinks to exit
some program to free memory, runs his or her plot command and it
crashes. The reason being, as I'm thinking, df_max_cols was adjusted
previously and the limit test thinks there is enough room for
df_max_cols when in fact that memory couldn't be allocated last time the
plot command was attempted.
There may be other similar instances of this and I'd say hold off
addressing it for a while.
Dan
|