[vox-tech] electric fence - error in man page? a bug?

[Peter Jay Salzman]

hola lugod,

according to the electric fence man page, pages of dynamic memory
which are free'd are returned back to the heap from whence they came.
in other words, if you do nothing, efence won't detect access of free'd
dynamic memory.

the man page goes on to say that you can set the global

   extern int EF_PROTECT_FREE;

or the shell variable

   EF_PROTECT_FREE

to the value 1 to intercept free() and keep them allocated.  this allows
electric fence to catch read/write access to free'd memory.

in my little hello world program:

   #include <stdio.h>
   #include <stdlib.h>
   
   int main(void)
   {
      int *a = (int *) malloc( 3*sizeof(int) );
   
      for (int i = 0; i < 3; ++i)
         a[i] = i;
   
      free(a);
   
      printf("%d\n", a[1]);
      return 0;
   }

i've found that efence will cause a segfault on the read of free'd
memory, even though i never set EF_PROTECT_FREE to 1.  this is contrary
to what i understand from the man page.

in fact, i tried to explicitly set the int to 0:

   #include <stdio.h>
   #include <stdlib.h>
   extern int EF_PROTECT_FREE;
   
   int main(void)
   {
      EF_PROTECT_FREE = 0;
      int *a = (int *) malloc( 3*sizeof(int) );
   
      for (int i = 0; i < 3; ++i)
         a[i] = i;
   
      free(a);
   
      printf("%d\n", a[1]);
      return 0;
   }

and it still segfaults on the last printf() statement.   i also tried:

   export EF_PROTECT_FREE=0

and the printf() still segfaults.


perhaps i'm non understanding the manpage correctly, but it looks like
this is a bug in electric fence.  everything else i've read in the
manpage seems accurate.

comments?

pete

ps- quite a relevent question for tonight, considering the author of
efence.   :-)

-- 
First they ignore you, then they laugh at you, then they fight you,
then you win. -- Gandhi, being prophetic about Linux.

Fingerprint: B9F1 6CF3 47C4 7CD8 D33E 70A9 A3B9 1945 67EA 951D