strange memory errors

[Philip Thiem <ptt@umr.edu>]

I am running libc6.2.1.2-9 and stdc++2.10 2.95.2-2  in the last couple of
week I
upgraded to these packages and begun having some strange memory related
errors.

I've been working on some code in C/C++, and part of this involved a simple
string
class that takes caring of memory allocation, automated growing and
shrinking of
the character string memory, and null termination. I to use calloc as the
method of memory allocation so I would have less worries about null
termination and
garbage in the string "buffer."  

All had seemed to work well, until I upgraded to these last releases, and
my program started crashing.  I pulled out gdb, and the first time gdb
reports a segfault in free().  I wasn't doing anything like freeing a freed
pointer, in fact, inside this class free is only called on destruction and
and reallocation.  The only other related function in used was of course
calloc() and also memncpy().  I am fairly certain certain my code was not
the source of the probably.  Recently I notice with a newer version of my
program I got working elsewhere, it wasn't crashing in free, but I was
getting strange behavior from calloc.  I would run this on a system with
128megs of ram with only a couple consoles open, and calloc would return
NULL.  which eventually in my class causes a bad_alloc exception to be
thrown.  I can upload this code to a ultrasparc and it will execute and
compile just fine(under g++ probably different version)  

Is there some new bug in this version of libc?  I am attaching a copy of my
main memory reallocation function recalloc, and inthis case I am passing a
reference to the string
size variable, 36 for the size, and null for the void pointer.

Philip Thiem
-- 
Philip Thiem /---/ ptt@umr.edu /---/ Pass on the GAS get NASM instead
    Computer Science & Mathematics Undergraduate @ UM-Rolla
    Interests: Security, Operating Systems, Numerical Computing,
               Algorithm Analysis, Discrete/Linear/Modern Algebra,

#include "memory.h"

/**********************************************************
** recalloc
**---------------------------------------------------------
**THIS IS A SWEET FUNCTION
** It uses calloc for dynamically resizing memory sizes
** *s must represent **t -- PERIOD
** all out arguments ARE LEFT ALONE till possibility of
**    error has passed.  so if you get an error the
**    memory is still intact
**here are the for arugments
**     *s = ns nothing happens
**     *s zero and ns is non-zero  acts like calloc
**     *s non-zero and ns is zero  acts like free
**     otherwise ns is callocated, and the min(*s,ns) 
**        is copied
**return codes
**  0 aokay
**  BADINFO stop giving me bad information
**  COPYERR should never happen, an error in copying
**  MEMERR  error allocating RAM
** ****************************************************/
size_t recalloc (unsigned long *s, 
		 unsigned long ns, 
		 void ** t)
{
   void * n=0;                        /* a temp allocated memory variable */

   if (!s || !t) return BADINFO;
   
   if (!(*t || *s) || (*t && *s))     /* if *t <=> *s                     */
   {
      if (*s == ns) return 0;            /* nothing to do if no sz change */

      if (ns)                            /* if there is a new size > 0    */
      {
         if((n=calloc(ns,1)))                 /* if memory can be allocated */
         {
            if (*s)                            /* if there exists data    */
            {
               if (!memcpy(n, *t, MIN(*s, ns)))  /* if is uncopiable     */
               {
                  free(n);                            /*free the new mem   */
                  return COPYERR;                    /*return an error    */
               }
               free(*t);                              /*free if ok         */
            }
	 }
         else return MEMERR;                /* no memory allocate is err  */
      }
      else free(*t);                        /* act like free by (*s <> ns)*/
                                            /* as *t <=> *s               */
      *s = ns;                              /* *s <= new size             */
      *t = n;                               /* change old to new          */
      return 0;                             /* return aokay               */
   }
   
   return BADINFO;                          /* and error of course        */
}