HEAP CORRUPTION DETECTED

[lauthrul]

System Details

Platform: Windows 11 10.0.22000 64bit
Version: libffi_3.4.4_x64

Problems Description

I'm using 64bit version of libffi, code as below, when run at delete c, there occurated a fatal error:

"HEAP CORRUPTION DETECTED: after Normal block (#1906) at 0x000001BFF6AA5650.
CRT detected that the application wrote to memory after end of heap buffer."

I checked the memory, before ffi_call() peformed, the memory of variable c is: ff ff ff ff, fd fd fd fd, and after that it is: 03 00 00 00, 00 00 00 00. As int is 4 byte, so, it should be expected to 03 00 00 00, fd fd fd fd. It seems like that ffi_call write 8 byte to it. Is this libffi's bug or did I used it in a wrong way?

void test0()
{
    ffi_cif cif;
    ffi_arg ret;
    ffi_type* argTypes[2] = { &ffi_type_sint, &ffi_type_sint };
    int* a = new int(1);
    int* b = new int(2);
    int* c = new int; // "cd cd cd cd, fd fd fd fd"
    int* d = new int(-1);
    void* args[2] = { a, b };

    auto func = lib.resolve("?Add@@YAHHH@Z"); // function is: int Add(int a, int b);

    auto status = ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 2, &ffi_type_sint, argTypes);
    assert(status == FFI_OK);

    *c = 10; // "0a 00 00 00, fd fd fd fd"
    memcpy(c, d, sizeof(d)); // "ff ff ff ff, fd fd fd fd"

    ffi_call(&cif, FFI_FN(func), c, args);  // "03 00 00 00, 00 00 00 00", HEAP CORRUPTION here!
    assert(*c == 3);

    delete a;
    delete b;
    delete c; // HEAP CORRUPTION DETECTED
    delete d;
}

[atgreen]

I think this is user error. Your buffer holding the return value needs to be register-sized. This is explained in the documentation. And have a look at the test suite to see how they use ffi_arg (which is register sized) for the return buffer for any type smaller than a register.

…

On Thu, May 25, 2023 at 5:29 AM lauthrul ***@***.***> wrote: System Details Platform: Windows 11 10.0.22000 64bit Version: libffi_3.4.4_x64 Problems Description I'm using 64bit version of libffi, code as below, when run at delete c, there occurated a fatal error: "HEAP CORRUPTION DETECTED: after Normal block (#1906) at 0x000001BFF6AA5650. CRT detected that the application wrote to memory after end of heap buffer." I checked the memory, before ffi_call() peformed, the memory of variable c is: ff ff ff ff, fd fd fd fd, and after that it is: 03 00 00 00, 00 00 00 00. As int is 4 byte, so, it should be expected to 03 00 00 00, fd fd fd fd. It seems like that ffi_call write 8 byte to it. Is this libffi's bug or did I used it in a wrong way? void test0() { ffi_cif cif; ffi_arg ret; ffi_type* argTypes[2] = { &ffi_type_sint, &ffi_type_sint }; int* a = new int(1); int* b = new int(2); int* c = new int; // "cd cd cd cd, fd fd fd fd" int* d = new int(-1); void* args[2] = { a, b }; auto func = lib.resolve("?Add@@***@***.***"); // function is: int Add(int a, int b); auto status = ffi_prep_cif(&cif, FFI_DEFAULT_ABI, 2, &ffi_type_sint, argTypes); assert(status == FFI_OK); *c = 10; // "0a 00 00 00, fd fd fd fd" memcpy(c, d, sizeof(d)); // "ff ff ff ff, fd fd fd fd" ffi_call(&cif, FFI_FN(func), c, args); // "03 00 00 00, 00 00 00 00", HEAP CORRUPTION here! assert(*c == 3); delete a; delete b; delete c; // HEAP CORRUPTION DETECTED delete d; } — Reply to this email directly, view it on GitHub <#779>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAV7CMMR2WAGH5ZY3NHUFLXH4Q65ANCNFSM6AAAAAAYOR7EP4> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>