valgrind complaints on curl with libidn

[Daniel Stenberg]

Hi,

My system: Debian Linux 32bit x86. Linux kernel 3.0.0, libc 2.13-21.

I have valgrind-3.6.1 and the Debian packaged version of libidn 1.22 (1.22-3) 
and I also tried 1.22 built from source. AFAIK, 1.22 is the most recent 
version.

When I now invoke curl to use a IDN domain valgrind reports an error within 
libidn:

$ valgrind curl -x localhost:80 http://www.åäö.se/page/165

The curl code using libidn has not been changed for years and it has not been 
getting this report in the past. I've not tried to bisect as to when the 
problem started to appear.

(This test failure can be seen with test 165 in the curl test suite.)

My valgrind output with debug versions of curl, libcurl and libidn looks like:

==17087== Memcheck, a memory error detector
==17087== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==17087== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
==17087== Command: ../src/curl --output log/curl165.out --include --verbose 
--trace-time http://www.åäö.se/page/165 -x 127.0.0.1:8990
==17087== Parent PID: 17086
==17087==
==17087== Invalid read of size 4
==17087==    at 0x4043967: idna_to_ascii_4z (idna.c:519)
==17087==    by 0x4043BF4: idna_to_ascii_8z (idna.c:570)
==17087==    by 0x808237B: resolve_server (url.c:4572)
==17087==    by 0x808331A: create_conn (url.c:5063)
==17087==    by 0x80835A0: Curl_connect (url.c:5194)
==17087==    by 0x808F3A9: connect_host (transfer.c:1988)
==17087==    by 0x808F683: Curl_do_perform (transfer.c:2126)
==17087==    by 0x808F9E9: Curl_perform (transfer.c:2272)
==17087==    by 0x8064DCD: curl_easy_perform (easy.c:537)
==17087==    by 0x805A551: operate (tool_operate.c:1217)
==17087==    by 0x8055F30: main (tool_main.c:92)
==17087==  Address 0x47e9c9c is 12 bytes inside a block of size 15 alloc'd
==17087==    at 0x4025102: realloc (in 
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==17087==    by 0x40439BD: idna_to_ascii_4z (idna.c:519)
==17087==    by 0x4043BF4: idna_to_ascii_8z (idna.c:570)
==17087==    by 0x808237B: resolve_server (url.c:4572)
==17087==    by 0x808331A: create_conn (url.c:5063)
==17087==    by 0x80835A0: Curl_connect (url.c:5194)
==17087==    by 0x808F3A9: connect_host (transfer.c:1988)
==17087==    by 0x808F683: Curl_do_perform (transfer.c:2126)
==17087==    by 0x808F9E9: Curl_perform (transfer.c:2272)
==17087==    by 0x8064DCD: curl_easy_perform (easy.c:537)
==17087==    by 0x805A551: operate (tool_operate.c:1217)
==17087==    by 0x8055F30: main (tool_main.c:92)
==17087==
==17087==
==17087== HEAP SUMMARY:
==17087==     in use at exit: 400 bytes in 4 blocks
==17087==   total heap usage: 3,582 allocs, 3,578 frees, 446,556 bytes 
allocated
==17087==
==17087== LEAK SUMMARY:
==17087==    definitely lost: 0 bytes in 0 blocks
==17087==    indirectly lost: 0 bytes in 0 blocks
==17087==      possibly lost: 0 bytes in 0 blocks
==17087==    still reachable: 400 bytes in 4 blocks
==17087==         suppressed: 0 bytes in 0 blocks
==17087== Reachable blocks (those to which a pointer was found) are not shown.
==17087== To see them, rerun with: --leak-check=full --show-reachable=yes
==17087==
==17087== For counts of detected and suppressed errors, rerun with: -v
==17087== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 63 from 10)


--

 / daniel.haxx.se