Hey all

Attached patch crashes Pd, at least on Ubuntu 16.04 amd64. Pd 0.48 and 0.47-1 seems affected, but not 0.46-7. Also, I cannot make it crash with the current 0.48 release for Windows under Wine. I couldn't test it on macOS, but the original patch (not this reduced one) crashes on macOS 10.11 with Pd 0.48.

The patch doesn't do anything meaningful anymore more, since I tried to remove anything that was not needed for the crash.

With current git master, I get the following backtrace printed to the console, as soon as I click the bang:

$ pd -stderr -nosound -open crashtest.pd  *** Error in `pd': corrupted size vs. prev_size: 0x0000000000b5e0a0 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f8f72df17e5] /lib/x86_64-linux-gnu/libc.so.6(+0x80dfb)[0x7f8f72dfadfb] /lib/x86_64-linux-gnu/libc.so.6(+0x83409)[0x7f8f72dfd409] /lib/x86_64-linux-gnu/libc.so.6(realloc+0x179)[0x7f8f72dfe839] pd(resizebytes+0x23)[0x47d183] pd(binbuf_text+0xf6)[0x47d3d6] pd[0x48d561] pd(socketreceiver_read+0x288)[0x48e6e8] pd[0x48d8c5] pd(m_mainloop+0x82f)[0x48a21f] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f8f72d9a830] pd(_start+0x29)[0x4138e9] ======= Memory map: ======== ... skipped ...

gdb backtrace:

(gdb) backtrace #0  0x00007ffff6dcf428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 #1  0x00007ffff6dd102a in __GI_abort () at abort.c:89 #2  0x00007ffff6e117ea in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffff6f2ae98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3  0x00007ffff6e1adfb in malloc_printerr (ar_ptr=0x7ffff715eb20 <main_arena>, ptr=0x827c20, str=0x7ffff6f27c35 "corrupted size vs. prev_size", action=3) at malloc.c:5006 #4  _int_free (av=0x7ffff715eb20 <main_arena>, p=<optimized out>, have_lock=1) at malloc.c:4014 #5  0x00007ffff6e1d409 in _int_realloc (av=av@entry=0x7ffff715eb20 <main_arena>, oldp=oldp@entry=0x827b00, oldsize=oldsize@entry=288, nb=nb@entry=112) at malloc.c:4384 #6  0x00007ffff6e1e839 in __GI___libc_realloc (oldmem=0x827b10, bytes=96) at malloc.c:3045 #7  0x00000000004b5783 in resizebytes (old=<optimized out>, oldsize=256, newsize=<optimized out>) at m_memory.c:55 #8  0x00000000004a7ae6 in binbuf_text (x=0x7d3ba0, text=text@entry=0x7fffffffcce0 "\r\n.x7e8880 motion 39.0 78.0 0;", size=size@entry=30) at m_binbuf.c:199 #9  0x00000000004c0b15 in socketreceiver_doread (x=x@entry=0x7ef580) at s_inter.c:494 #10 0x00000000004c214c in socketreceiver_read (x=0x7ef580, fd=12) at s_inter.c:597 #11 0x00000000004c0e8e in sys_domicrosleep (microsec=<optimized out>, pollem=1) at s_inter.c:230 #12 0x00000000004c1585 in sys_microsleep (microsec=<optimized out>) at s_inter.c:254 #13 0x00000000004b9fda in m_pollingscheduler () at m_sched.c:541 #14 m_mainloop () at m_sched.c:596 #15 0x00007ffff6dba830 in __libc_start_main (main=0x414aa0 <main>, argc=6, argv=0x7fffffffe048, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe038)     at ../csu/libc-start.c:291 #16 0x0000000000414ad9 in _start ()

Roman