Question

EDIT: Changed Title to ignore my assumption.

I have a library, written in c, which uses posix message queue to pass pointers to some runtime data between threads.

In cases where the data is coming from user application, everything seems to work fine, and I am able to access the data pointed by the pointer to a structure, coming from the message queue.

Now, I have a special case where the library itself will do a malloc of one instance of the structure, set a flag and send it to the same queue. On the receiving end, the structure is empty and the flag is zero. Calling free on the pointer causes a crash.

Here’s code:

volatile s_thestruct * volatile data = malloc(sizeof(s_thestruct));
data->flags = THE_FLAG;
mq_send(handle, (char *)&data, sizeof(s_thestruct *), 1)

And on the receiving end:

ssize_t read = mq_receive(handle, (char*)&data, sizeof(s_thestruct*), NULL);
if(read != sizeof(s_thestruct *))
{
 // Error handling, no problems here
}
if(data->flags == THE_FLAG)
{
// Do something, never gets here
}
// Do something else, no it is not freed here

// Finally
free(data); // <--CRASH

And I will get:

*** glibc detected *** /usr/bin/applicationthingy: free(): invalid pointer: 0x08053cf0 ***

Followed by dump.
Within the memory map dump I find:

....
08048000-0804a000 r-xp 00000000 08:01 802680     /usr/bin/applicationthingy
0804a000-0804b000 r--p 00001000 08:01 802680     /usr/bin/applicationthingy
0804b000-0804c000 rw-p 00002000 08:01 802680     /usr/bin/applicationthingy
0804c000-0806f000 rw-p 00000000 00:00 0          [heap]
b6e00000-b6e21000 rw-p 00000000 00:00 0 
....

So, anyone got any suggestions of what’s going on here?

Answer 1

That (passing pointers) should work okay, assuming they’re from the same address space.

The only thing I can think of is if there’s a chance the queue could be being written from a separate process? That would make pointers useless since what they’re pointing to is totally different in different processes.

To be honest though, I wouldn’t pass pointers around like that unless the structure itself was massive. If you pass the structure, you gain all the advantages of being able to do proper inter-process queues.

The other thing to check is is the library is somehow getting its allocations from a different memory arena than your main code. That would be a circumstance that would cause the free failure but probably not the incorrect flags since, even if they’re using different arenas, they would both be in the same address space.

At a bare minimum, you should be printing out the value of data on the sending and receiving side, to ensure that it’s coming through unscathed. It’s entirely possible some other piece of code could be corrupting it (a la buffer overflows and so forth).