1.
Heap Corruption/
corruption?
Ferry Chen
2015 Spring @FIH

2.
Agenda
Memory & Heap & Stack
Symptoms
Analysis Tools
How to address
Case Study & QA time

3.
Memory
A pool or space used to store program or data in a computer.
W.L.O.G., memory will be managed by OS.

4.
Heap
an area of memory used for dynamic memory allocation
W.L.O.G., memory will be managed by OS.

5.
Stack
stack data structure that stores information about the active
subroutines of a computer program
size limited

6.
Symptoms
signal 6 (SIGABRT), code -6 (SI_TKILL)
SIGMAPPER may also be the symptoms
Double Free
Broken Data
Allocation Fail
heap corruption

7.
Tools ?
http://valgrind.org

8.
Tools
QCT/Porting/Compilation…….

9.
How to use?
valgrind [valgrind_args] your_program [your_program_args]
Report will be output to stderr

10.
Case Study on QCamera
Odin’s mm-qcamera-daemon,
QCT’s driver framework crash randomly

11.
Init rc
#start camera server as daemon
service qcamerasvr /system/bin/mm-qcamera-daemon
class late_start
user camera
group camera system inet input graphics
#start camera server as daemon
service qcamerasvr /system/bin/valgrind --tool=memcheck --leak-check=yes
--log-file=/data/logs/camera_valgrind.log /system/bin/mm-qcamera-daemon

12.
Invalid Read/Write
==19182== Invalid write of size 4
....??
==19182== Invalid read of size 4
....??

13.
Using debug libraries
at Runtime
To get more info, e.g.
filename, and #line

14.
module_imglib.c
module_imglib_clear_session_params()
p_list = mct_list_find_custom(p_mod->session_params_list, &sessionid,
module_imglib_find_session_params);
if (p_list && p_list->data) {
p_mod->session_params_list =
mct_list_remove(p_mod->session_params_list, p_list->data);
free(p_list->data);
}
return TRUE;

15.
p_list = mct_list_find_custom(p_mod->session_params_list, &sessionid,
module_imglib_find_session_params);
void* datap = p_list->data;
if (p_list && p_list->data) {
p_mod->session_params_list =
mct_list_remove(p_mod->session_params_list, p_list->data);
free(datap);
}
return TRUE;

16.
Questions?