#2 Memory corruption caused by %obj_set_field in dynArray.ml
What steps will reproduce the problem?
Example program:
-----------------------------------------------------------------------------
(* compile with:
ocamlfind ocamlc -package extlib -I +extlib -linkpkg -o dynarr_example \
dynarr_example.ml *)
let dynarr_example prefix =
let d = ref (DynArray.create ()) and n = 4100 in
for i = 0 to n do
Printf.printf "%d %d\n" i (DynArray.length !d); flush stdout;
DynArray.insert !d 0 (Array.create (42) "")
done;;
let _ = dynarr_example ();;
-----------------------------------------------------------------------------
What is the expected output? -- A series of numbers up to 3999.
What do you see instead? -- The series is interrupted by a segmentation fault.
-----------------------------------------------------------------------------
/pj/ocaml/dynarr_example% ocamlc -v
The Objective Caml compiler, version 3.11.0
Standard library directory: /home/bruno/godi/lib/ocaml/std-lib/
~/pj/ocaml/dynarr_example% ./dynarr_example
0 0
1 1
2 2
3 3
4 4
5 5
6 6
7 7
[...]
3382 3382
3383 3383
3384 3384
3385 3385
3386 3386
3387 3387
3388 3388
3389 3389
zsh: 15042 segmentation fault ./dynarr_example
~/pj/ocaml/dynarr_example%
-----------------------------------------------------------------------------
What version of the product are you using? On what operating system?
extlib 1.5.1 on Linux (The same problem shows up on Mingw).
Please provide any additional information below.
It must read d.len - 2 instead of d.len - 1 in the indicated line of
dynArray.ml, because the
size of the array d has alrady been increased at this point.
For this reason, "iset d.arr (i+1)" later goes out of bounds.
-----------------------------------------------------------------------------
let insert d idx v =
if idx < 0 || idx > d.len then invalid_arg idx "insert" "index";
if d.len = ilen d.arr then changelen d (d.len + 1) else d.len <-
d.len +
1;
if idx < d.len - 1 then begin
for i = d.len - 1 downto idx do <=============== d.len - 2
iset d.arr (i+1) (iget d.arr i)
done;
end;
iset d.arr idx v
-----------------------------------------------------------------------------
Patch correcting the bug