In case anyone's curious, how I went from "uhg!" to a fix in 30 minutes: a short thread.
First step wasn't really necessary, but was observing the point of trap in musl's free and finding it was the check byte one past end of usable storage. Examined contents with gdb x command, found only 1 byte clobbered.
OK, no symbols in SDL_mixer, so I grabbed source and built my own and LD_PRELOADed it. Set gdb breakpoint at "malloc if n==65851" (the size of the object that was causing trap on free). Found point of allocation.
Performed "finish", got return value of malloc (call it p), set "watch *(char*)(p+65851)" in gdb, "continue". Stopped on statement performing the clobber.
Read function, allocation size logic was obviously wrong, allocating +1 byte for an extra slot past end but slots were 16-bit samples. Changed, ran make, everything worked.
You can follow @RichFelker.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled:

By continuing to use the site, you are consenting to the use of cookies as explained in our Cookie Policy to improve your experience.