getline() bug

[John V. Shahid]

Hi everyone,

I think I found a bug in getline(). It seems like getline() can't handle
lines with 1444 characters in it. Below is the source code for
regenerating the problem. The first test case include a result set from
one of the databases I'm currently using; it contains 30 short lines.
The second test case include a file with one big line (1444 characters).
The first test case succeed with no errors from glibc, and no errors in
valgrind. The second test case fails with errors from both valgrind and
glibc and are shown below.The details are below :

Configuration:

OS: Linux 2.6.18 (fc6 build) running on x86_64 platform
gcc: 4.1.1
glibc: 2.5
valgrind: 3.2.1

******************************Code:****************************
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char* argv[])
{
    FILE* input;
    char* line;
    int lineSize, count;

    if(argc != 2)
    {
        printf("Syntax : %s {file name}.\n", argv[0]);
        return EXIT_FAILURE;
    }

    line = NULL;
    lineSize = 0;

    input = fopen(argv[1], "r");
    while((getline(&line, &lineSize, input)) != -1)
    {
        printf("%s", line);
    }
    free(line);
    return EXIT_SUCCESS;
}

*************************Test file 1:******************************

 i_id | i_im_id |          i_name          | i_price |
i_data
------+---------+--------------------------+---------+----------------------------------------------------
    5 |       6 |                          |         |
   22 |         |                          |    2500 |
   16 |         | desktop                  |         |
   10 |       7 | stereo                   |    2000 |
    4 |         | television               |    4000 |
   26 |       8 |                          |         | Brand One
   18 |       6 |                          |    3000 |
   14 |         |                          |         |
   19 |         | stereo                   |         | Brand One
   20 |       9 | camera                   |         |
    8 |         |                          |     500 | Brand Two
   17 |       1 |                          |    3000 | Brand One
   28 |       4 | camera                   |         | Brand Two
   11 |         | laptop                   |    1000 | Brand Two
   29 |         |                          |         | Brand Two
   21 |       2 | desktop                  |    1000 | Brand Two
   13 |       7 | laptop                   |     500 | Brand One
    2 |       1 | air conditioner          |    4500 | Brand Two
   23 |       7 | desktop                  |     500 | Brand One
   25 |       4 | camera                   |    4000 | Brand One
    1 |       3 | laptop                   |    1000 | Brand One
    3 |       7 | television               |    2500 | Brand One
   15 |       5 | laptop                   |    1000 | Brand Two
    9 |       2 | camera                   |    1000 | Brand One
   24 |       9 | camera                   |    1000 | Brand Two
    7 |       9 | desktop                  |    3500 | Brand One
   27 |       2 | air conditioner          |    1000 | Brand Two
   12 |       1 | stereo                   |     500 | Brand One
    6 |       1 | television               |    1500 | Brand One
   30 |       1 | laptop                   |     500 | Brand One
(30 rows)

***************Test file 2 (the following is one big line)*************
 information_schema | table_privileges                | pg_control  |
SELECT (u_grantor.rolname)::information_schema.sql_identifier AS
grantor, (grantee.rolname)::information_schema.sql_identifier AS
grantee, (current_database())::information_schema.sql_identifier AS
table_catalog, (nc.nspname)::information_schema.sql_identifier AS
table_schema, (c.relname)::information_schema.sql_identifier AS
table_name, (pr."type")::information_schema.character_data AS
privilege_type, (CASE WHEN aclcontains(c.relacl,
makeaclitem(grantee.oid, u_grantor.oid, pr."type", true)) THEN
'YES'::text ELSE 'NO'::text END)::information_schema.character_data AS
is_grantable,
('NO'::information_schema.character_data)::information_schema.character_data AS 
with_hierarchy FROM pg_class c, pg_namespace nc, pg_authid u_grantor, (SELECT 
pg_authid.oid, pg_authid.rolname FROM pg_authid UNION ALL SELECT (0)::oid AS 
oid, 'PUBLIC') grantee(oid, rolname), ((((((SELECT 'SELECT' UNION ALL SELECT 
'DELETE') UNION ALL SELECT 'INSERT') UNION ALL SELECT 'UPDATE') UNION ALL 
SELECT 'REFERENCES') UNION ALL SELECT 'RULE') UNION ALL SELECT 'TRIGGER') 
pr("type") WHERE ((((c.relnamespace = nc.oid) AND ((c.relkind = 'r'::"char") OR 
(c.relkind = 'v'::"char"))) AND aclcontains(c.relacl, makeaclitem(grantee.oid, 
u_grantor.oid, pr."type", false))) AND ((pg_has_role(u_grantor.oid, 
'MEMBER'::text) OR pg_has_role(grantee.oid, 'MEMBER'::text)) OR 
(grantee.rolname = 'PUBLIC'::name)));

*******************Error from glibc for test case 1*********************

Nothing, successful

****************Results of valgrind on test case 1**********************

Successful with no errors.

*****************Error from glibc for test case 2***********************

*** glibc detected *** ./a.out: double free or corruption (!prev):
0x0000000000601250 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3843a6ea60]
/lib64/libc.so.6(cfree+0x8c)[0x3843a7217c]
./a.out[0x4005dd]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x3843a1da44]
./a.out[0x4004b9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 03:04
196033                             
/john/projects/learning/diffing_unordered_files/a.out
00600000-00601000 rw-p 00000000 03:04
196033                             
/john/projects/learning/diffing_unordered_files/a.out
00601000-00622000 rw-p 00601000 00:00 0
[heap]
3842a00000-3842a1a000 r-xp 00000000 03:02
195458                         /lib64/ld-2.5.so
3842c19000-3842c1a000 r--p 00019000 03:02
195458                         /lib64/ld-2.5.so
3842c1a000-3842c1b000 rw-p 0001a000 03:02
195458                         /lib64/ld-2.5.so
3843a00000-3843b44000 r-xp 00000000 03:02
195461                         /lib64/libc-2.5.so
3843b44000-3843d44000 ---p 00144000 03:02
195461                         /lib64/libc-2.5.so
3843d44000-3843d48000 r--p 00144000 03:02
195461                         /lib64/libc-2.5.so
3843d48000-3843d49000 rw-p 00148000 03:02
195461                         /lib64/libc-2.5.so
3843d49000-3843d4e000 rw-p 3843d49000 00:00 0
3848200000-384820d000 r-xp 00000000 03:02
195492                         /lib64/libgcc_s-4.1.1-20061011.so.1
384820d000-384840c000 ---p 0000d000 03:02
195492                         /lib64/libgcc_s-4.1.1-20061011.so.1
384840c000-384840d000 rw-p 0000c000 03:02
195492                         /lib64/libgcc_s-4.1.1-20061011.so.1
2aaaaaaab000-2aaaaaaae000 rw-p 2aaaaaaab000 00:00 0
2aaaaaada000-2aaaaaadc000 rw-p 2aaaaaada000 00:00 0
2aaaac000000-2aaaac021000 rw-p 2aaaac000000 00:00 0
2aaaac021000-2aaab0000000 ---p 2aaaac021000 00:00 0
7fff27bb8000-7fff27bcd000 rw-p 7fff27bb8000 00:00 0
[stack]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0
[vdso]
Aborted

*********************Result from valgrind with case 2*************
==4355== Invalid write of size 1
==4355==    at 0x4A0710B: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C3983B is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== Invalid write of size 1
==4355==    at 0x4A07111: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C3983A is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== Invalid write of size 1
==4355==    at 0x4A07118: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C39839 is not stack'd, malloc'd or (recently)
free'd
==4355== Invalid write of size 1
==4355==    at 0x4A07111: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C3983A is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== Invalid write of size 1
==4355==    at 0x4A07118: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C39839 is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== Invalid write of size 1
==4355==    at 0x4A07123: memcpy (mc_replace_strmem.c:406)
==4355==    by 0x3843A5FA5E: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C39838 is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== Invalid write of size 1
==4355==    at 0x3843A5FA78: getdelim (in /lib64/libc-2.5.so)
==4355==    by 0x4005B9: main (another_test.c:19)
==4355==  Address 0x4C3983C is not stack'd, malloc'd or (recently)
free'd
==4355==
==4355== ERROR SUMMARY: 1325 errors from 5 contexts (suppressed: 5 from
1)
==4355== malloc/free: in use at exit: 568 bytes in 1 blocks.
==4355== malloc/free: 2 allocs, 1 frees, 688 bytes allocated.
==4355== For counts of detected errors, rerun with: -v
==4355== searching for pointers to 1 not-freed blocks.
==4355== checked 68,960 bytes.
==4355==
==4355== LEAK SUMMARY:
==4355==    definitely lost: 0 bytes in 0 blocks.
==4355==      possibly lost: 0 bytes in 0 blocks.
==4355==    still reachable: 568 bytes in 1 blocks.
==4355==         suppressed: 0 bytes in 0 blocks.