by g1real » Sun Sep 20, 2015 6:55 pm loftar wrote:And yes, indeed, 'tis actually quite interesting. It's not that unusual for debugging techniques to perturb away a bug of an unknown nature, of course, but given the nature of the debugging technique, it seems to leave me with little choice but to think that the actual bug is not a double-free problem, but rather a use-after-free problem, which does surprise me quite a bit given the nature of the effects I was seeing. It should be easy enough to test once I adapt the debugging code, anyway.
Just in case anyone of the more technically inclined are interested, the debugging technique I am using is a fairly simple malloc-wrapper which lets chunks "lie fallow" for some time after being freed before being actually reclaimed, along with a tag-word to detect double frees. It looks like this. I figure I should be rather easily able to detect use-after-free bugs by filling the fallow chunks with static data and check so that that data is still intact once the block is reclaimed.
So it's been a memory problem all this time then?
Edit: Give more details, it's massively interesting.
