[UPnP-SDK-discuss] Chrashing while trying to read the file from httpd server

[Sangita P <sp....@ya...>]

Hi All,

I am using http client of libupnp-1.4.6.
Note : Linux version which I am using is fedora core 6.

When I tried to read the file from  httpd server with test application. 

Test Application:

#include<stdio.h>
#include<upnp.h>

int main(int argc,char * argv[])
{
    char *url_str_a = "http://localhost/filename.mts";
    void * Handle_a ;
    char contentType_a ;
    int contentLength_a ;
    int httpStatus_a ;
    int timeout_a = 1;
    char *buf_a = (char *) malloc(2048);
    unsigned int sizeOfBuffer = 2048 ,ReadRemainingBytes = 0;
    int ReadBytes =0 ;
        int retVal = 0;
    if(UPNP_E_SUCCESS == UpnpInit(NULL,80))
    {
        if(UpnpOpenHttpGet( url_str_a, &Handle_a,&contentType_a,&contentLength_a,&httpStatus_a, timeout_a ) == UPNP_E_SUCCESS)
        {    
            ReadBytes = contentLength_a/sizeOfBuffer ;
            
            while(i<=ReadBytes)
            {    
                memset(buf_a, 0, sizeOfBuffer);     
                retVal = UpnpReadHttpGet(Handle_a,buf_a,&sizeOfBuffer,timeout_a);
                                if ( retVal == UPNP_E_SUCCESS)
                {
                      printf("UpnpReadHttpGet is successful\n");
                
                }
                else
                {
                    printf("READ ERROR\n");
                                        printf("retVal = %d\n",retVal);
                    break;
                }
            
            }
        }
                
        
    }

    return 0;
}

I have a printf in membuffer_set_size() for  the alloc_len. 

int
membuffer_set_size( INOUT membuffer * m,
                    IN size_t new_length )
{
    size_t diff;
    size_t alloc_len;
    char *temp_buf;

    if( new_length >= m->length )   // increase length
    {
        // need more mem?
        if( new_length <= m->capacity ) {
            return 0;           // have enough mem; done
        }

        diff = new_length - m->length;
        alloc_len = MAXVAL( m->size_inc, diff ) + m->capacity;
    } else                      // decrease length
    {
        assert( new_length <= m->length );

        // if diff is 0..m->size_inc, don't free
        if( ( m->capacity - new_length ) <= m->size_inc ) {
            return 0;
        }

        alloc_len = new_length + m->size_inc;
    }

    assert( alloc_len >= new_length );
        printf("alloc-len = %ld\n",alloc_len); ////////////Printf added
    temp_buf = realloc( m->buf, alloc_len + 1 );    //LEAK_FIX_MK

      if( temp_buf == NULL ) {
        // try smaller size
        alloc_len = new_length;
        temp_buf = realloc( m->buf, alloc_len + 1 );    //LEAK_FIX_MK
         if( temp_buf == NULL ) {
            return UPNP_E_OUTOF_MEMORY;
        }
    }
    // save
    m->buf = temp_buf;
    m->capacity = alloc_len;
    return 0;
}
                                                                              



When I have run the test application. alloc_len is getting incremented in each iteration it can be seen in the log.

Log:

.....
alloc-len = 20304146
alloc-len = 20306194
alloc-len = 20308242
alloc-len = 20310290
alloc-len = 20312338
alloc-len = 20314386
....
alloc-len = 22364434
alloc-len = 22366482
alloc-len = 22368530
alloc-len = 22370578
alloc-len = 22372626
alloc-len = 22374674
alloc-len = 22376722
alloc-len = 22378770
alloc-len = 22380818
alloc-len = 22382866
....


Since memory is not getting freed, When I tried to run the same application on my platform, I m getting an chrash.



oom-killer: gfp_mask=0x201d2, order=0

Call trace:
[<8444244e>] out_of_memory+0x14e/0x200
[<84444706>] __alloc_pages+0x306/0x340
[<844469f4>] __do_page_cache_readahead+0x114/0x360
[<8447ca32>] sys_select+0x312/0x4e0
[<84535b74>] memset+0x0/0x4c
[<84440f92>] filemap_nopage+0x112/0x4e0
[<8443d260>] find_get_page+0x0/0xc0
[<8444dcc6>] __handle_mm_fault+0xc6/0xa20
[<84412fc2>] do_page_fault+0x102/0x3e0
[<845468da>] tty_ldisc_deref+0x7a/0xe0
[<84548e06>] tty_write+0xa6/0x280
[<84462f24>] vfs_write+0xc4/0x180
[<844638f8>] sys_write+0x38/0x80
[<84405068>] ret_from_exception+0x0/0x8
[<84405000>] tlb_miss_load+0x0/0x4

Mem-info:
DMA per-cpu:
cpu 0 hot: high 42, batch 7 used:6
cpu 0 cold: high 14, batch 3 used:2
DMA32 per-cpu: empty
Normal per-cpu: empty
HighMem per-cpu: empty
Free pages:        1276kB (0kB HighMem)
Active:21480 inactive:75 dirty:0 writeback:0 unstable:0 free:319 slab:438 mapped:21488 pagetables:37
DMA free:1276kB min:1280kB low:1600kB high:1920kB active:85920kB inactive:300kB present:102400kB pages_scanned:96633 all_unreclaimable? yes
lowmem_reserve[]: 0 0 0 0
DMA32 free:0kB min:0kB low:0kB high:0kB active:0kB inactive:0kB present:0kB pages_scanned:0 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
Normal free:0kB min:0kB low:0kB high:0kB active:0kB inactive:0kB present:0kB pages_scanned:0 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
HighMem free:0kB min:128kB low:128kB high:128kB active:0kB inactive:0kB present:0kB pages_scanned:0 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
DMA: 1*4kB 1*8kB 1*16kB 1*32kB 1*64kB 1*128kB 0*256kB 0*512kB 1*1024kB 0*2048kB 0*4096kB = 1276kB
DMA32: empty
Normal: empty
HighMem: empty
Swap cache: add 0, delete 0, find 0/0, race 0+0
Free swap  = 0kB
Total swap = 0kB
Free swap:            0kB
25600 pages of RAM
2504 reserved pages
8 pages shared
0 pages swap cached
Out of Memory: Kill process 602 (test-try-3.out) score 1387 and children.
Out of memory: Killed process 602 (test-try-3.out).
Killed



Any help will be appriciated.

Regards,
Sangita













       
---------------------------------
 Unlimited freedom, unlimited storage. Get it now