[Toybox] Sigh. Anybody spot the bug?

[Felix Janda]

Isaac wrote:
> On Wed, Jul 03, 2013 at 08:56:46PM +0200, Felix Janda wrote:
> > Rob Landley wrote:
> > > Tail has a double free somewhere. (Aboriginal's more/buildall.sh is  
> > > complaining, that uses toybox in host-tools.) Haven't had time to track  
> > > it down yet, wondering if anybody else could spot it.
> > > 
> > >  From the behavior it's looking like it's on file close...
> > [...]
> > 
> > It seems reproducible when using tail on non-seekable files which are bigger
> > than count*sizeof(toybuf) and contain no newlines.
>  
> I presume this is with TAIL_SEEK=y.

No. With TAIL_SEEK=n it's even easier to trigger. Just try to tail any large file.

> I'm not sure what "count*sizeof(toybuf)" means since count is a loop counter.
> Would a 4097-byte file with no \n cause it? Or 512*4096+1?
> (I'm wanting to test the other proposed solution.)

With count I meant the argument to the -n option (default 10). (Sorry for the
confusion.) Just do a

yes | paste -s | tail

to trigger the bug.

The other proposed solution can't solve this specific problem since the changed
code isn't touched in this situation.

Felix

 1373118722.0