[GH-ISSUE #102] incorrect list handling in copy_small_ranges #38

New issue

Open

opened 2026-10-26 22:23:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:23:58 +00:00

Owner

Originally created by @dirkmueller on GitHub (Sep 2, 2026).
Original GitHub issue: https://github.com/Comfy-Org/comfy-aimdo/issues/102

In src/malloc-graph.c, the copy_small_ranges function is defined as:

static bool copy_small_ranges(SmallRange **copy, SmallRange *range) {
    for (; range; range = range->next) {
        *copy = malloc(sizeof(**copy));
        if (!*copy) {
            return false;
        }
        **copy = *range;
        copy = &(*copy)->next;
    }
    return true;
}

If malloc fails during any iteration other than the first:

**copy = *range copy-assigns the entire struct, which includes copying the original list's range->next pointer.
copy = &(*copy)->next shifts the assignment target to the next pointer of the newly allocated range.
When the subsequent malloc fails, the loop exits with false without setting *copy (the next pointer of the prior allocated node) to NULL.
The partially copied list remains linked to the original live list starting from range->next.

This behavior leads to double-free corruption.

Originally created by @dirkmueller on GitHub (Sep 2, 2026). Original GitHub issue: https://github.com/Comfy-Org/comfy-aimdo/issues/102 In `src/malloc-graph.c`, the `copy_small_ranges` function is defined as: ```c static bool copy_small_ranges(SmallRange **copy, SmallRange *range) { for (; range; range = range->next) { *copy = malloc(sizeof(**copy)); if (!*copy) { return false; } **copy = *range; copy = &(*copy)->next; } return true; } ``` If `malloc` fails during any iteration other than the first: * `**copy = *range` copy-assigns the entire struct, which includes copying the original list's `range->next` pointer. * `copy = &(*copy)->next` shifts the assignment target to the `next` pointer of the newly allocated range. * When the subsequent `malloc` fails, the loop exits with `false` without setting `*copy` (the `next` pointer of the prior allocated node) to `NULL`. * The partially copied list remains linked to the original live list starting from `range->next`. This behavior leads to double-free corruption.

bsakaguchi referenced this issue

2026-10-26 22:24:20 +00:00

[PR #38] [MERGED] pyt-alloc-async: re-estimate async alloc costs #76