Re: array out-of-bounds in TBranch::GetBasket(Int_t basketnumber)

From: Rene Brun (Rene.Brun@cern.ch)
Date: Mon Nov 15 1999 - 17:09:25 MET


Hi Stefan,
Thanks for reporting this problem with fBasketRAM.
The logic in TBranch::DropBaskets has been modified. See new code below.
There is no need for a protection in TBranch::GetBasket.

Rene Brun


//______________________________________________________________________________
void TBranch::DropBaskets()
{
//   Loop on all branch baskets.  Drop all except readbasket

   Int_t i,j;
   TBasket *basket;
   if (fNBasketRAM < kMaxRAM) {
      for (i=0;i<kMaxRAM;i++) {
         j = fBasketRAM[i];
         if (j < 0) continue;
         if (j == fReadBasket || j == fWriteBasket) continue;
         basket = (TBasket*)fBaskets.UncheckedAt(j);
         if (!basket) continue;
         basket->DropBuffers();
         GetListOfBaskets()->RemoveAt(j);
         delete basket;
         fBasketRAM[i] = -1;
         fNBasketRAM--;
      }
      if (fNBasketRAM < 0) {
         printf("ERROR, fNBasketRAM =%d\n",fNBasketRAM);
         fNBasketRAM = 0;
      }
      i = 0;
      for (j=0;j<kMaxRAM;j++) {
         if (fBasketRAM[j] < 0) fBasketRAM[i] = fBasketRAM[j];
         i++;
      }
      return;
   }

stefan kluth wrote:
> 
> Hi,
> 
> I investigated mysterious crashes I had when reading ROOT files with
> purify, since I suspected memory corruption. I found that the array
> fBasketRAM in class TBranch is sometimes indexed with numbers < 0. I don't
> really understand how this happens, but I did this to get my stuff to run:
> 
> In file TREE_Branch.cxx:
> 
> ...
> 
> TBasket* TBranch::GetBasket(Int_t basketnumber) {
> 
> ...
> 
>    fBaskets[basketnumber] = basket;
> 
> // protect against fNBasketRAM < 0:
>    if( fNBasketRAM >= 0 ) {
>      if (fNBasketRAM < kMaxRAM) fBasketRAM[fNBasketRAM] = basketnumber;
>    }
>    else {
>      Warning("GetBasket","fNBasketRAM < 0, shouldn't happen!");
>    }
> 
>    fNBasketRAM++;
>    return basket;
> 
> }
> 
> I guess I leave it to the experts to find out how this can happen. I would
> also like some advice on the fix I did, i.e. if I should expect other
> problems now. I work with 2.23/07 on Solaris.
> 
> cheers, Stefan
> 
> ---Stefan Kluth---------------Lynen Fellow----------------|\--|\-------
> -  LBNL, MS 50A 2160       -  phone:  +1 510 495 2376  -  |/  |/      -
> -  1 Cyclotron Rd.         -  fax:    +1 510 495 2957  -  |\/\|\/\|'  -
> ---Berkeley, CA94720, USA-----e-mail: SKluth@lbl.gov------|/\/|/\/|----



This archive was generated by hypermail 2b29 : Tue Jan 04 2000 - 00:43:42 MET