[Freeciv-Dev] (PR#12015) Invalid free() from player_map_free()

["Benedict Adamson" <badamson@xxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=12015 >

The server development version of 2005-01-24 has an invalid call to the 
free() function, from function player_map_free(). This causes an 
infinite loop in the heap management code on my computer (GNU/Linux 
Debian sarge,  kernel 2.4.27-1-k7, gcc version 3.3.5 (Debian 1:3.3.5-6), 
libc6 2.3.2.ds1-20). Attached is a valgrind report of the problem (the 
valgrind heap management code detects the problem and therefore does not 
loop), and the autogame that produced it.

set gameseed 23
set mapseed 17

set size 1
set generator 2
set startpos 1
set aifill 3
set specials 1000
set startunits cccccxxxx
set dispersion 4
set researchcost 4
set foodbox 5
set huts 0
set barbarians 0
normal

set timeout -1
create Caesar
create Itzcoatl
create Hannibal

set endyear -1200
start

==9953== Memcheck, a memory error detector for x86-linux.
==9953== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al.
==9953== Using valgrind-2.2.0, a program supervision framework for x86-linux.
==9953== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al.
==9953== 
==9953== My PID = 9953, parent PID = 1759.  Prog and args are:
==9953==    server/civserver
==9953==    -r
==9953==    /home/benedict/freeciv/PR/pending/short.fc
==9953== For more details, rerun with: -v
==9953== 
==9953== Conditional jump or move depends on uninitialised value(s)
==9953==    at 0x1B97113F: (within /usr/lib/libz.so.1.2.2)
==9953==    by 0x1B970D0E: (within /usr/lib/libz.so.1.2.2)
==9953==    by 0x1B96F625: deflate (in /usr/lib/libz.so.1.2.2)
==9953==    by 0x1B96EC26: (within /usr/lib/libz.so.1.2.2)
==9953==    by 0x1B96E630: gzclose (in /usr/lib/libz.so.1.2.2)
==9953==    by 0x80AC941: fz_fclose (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x80A8423: section_file_save (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8050153: save_game (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8050381: save_game_auto (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x80517E2: main_loop (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8051949: srv_main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x804A6C7: main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953== 
==9953== Invalid free() / delete / delete[]
==9953==    at 0x1B905460: free (vg_replace_malloc.c:153)
==9953==    by 0x80789B7: player_map_free (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8052100: server_game_free (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x805045F: server_quit (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8051A00: srv_main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x804A6C7: main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==  Address 0x1BC704E0 is 0 bytes inside a block of size 44 free'd
==9953==    at 0x1B905460: free (vg_replace_malloc.c:153)
==9953==    by 0x80789B7: player_map_free (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8052100: server_game_free (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x805045F: server_quit (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x8051A00: srv_main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953==    by 0x804A6C7: main (in 
/home/benedict/svn-wd/weorc/freeciv.PR11995/server/civserver)
==9953== 
==9953== ERROR SUMMARY: 10 errors from 2 contexts (suppressed: 21 from 1)
==9953== malloc/free: in use at exit: 484619 bytes in 5344 blocks.
==9953== malloc/free: 466307 allocs, 460965 frees, 171379217 bytes allocated.
==9953== For a detailed leak analysis,  rerun with: --leak-check=yes
==9953== For counts of detected errors, rerun with: -v