Different behaviors depending on architecture

Question

It seems I have encountered a possible bug in libc. I have the following code:

#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <unistd.h>

struct bla
{
    int a,b,c,d;
};

pthread_t tid;

void print (const char *s, const struct bla *fp);

void * thr_fn1 ( void * arg);

int main()
{
    struct bla *bla_main;

    pthread_create (&tid,NULL,thr_fn1,NULL);
    pthread_join (tid, (void *)  &bla_main);
    print ("Old thread: \n",bla_main);
    return 0;
}

void print (const char *s, const struct bla *bla_print)
{
    printf ("%s\n",s);
    printf ("Struct address: %p\n",bla_print);
    printf ("fp.a = %d\n",bla_print->a);
    printf ("fp.b = %d\n",bla_print->b);
    printf ("fp.c = %d\n",bla_print->c);
    printf ("fp.d = %d\n",bla_print->d);
}

void * thr_fn1 ( void * arg)
{
    struct bla *bla_thr;

    bla_thr=  malloc(1);
    bla_thr->a=1;
    bla_thr->b=2;
    bla_thr->c=3;
    bla_thr->d=4;
    print ("Thread 1:\n",bla_thr);
    pthread_exit ((void *) bla_thr);
}

Compiling is done using gcc -Wall -pthread file.c which produces no error/warning. But, when I try to run it on my Raspberry Pi (32-bit), I get the following output:

[alex@ArchPi code]$ ./a.out 
Thread 1:

Struct address: 0xb6500468
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4
a.out: malloc.c:2365: sysmalloc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted (core dumped)

[alex@ArchPi code]$ file a.out 
a.out: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.27, BuildID[sha1]=33e5d87872f0b40924a709fe266d47f9f011a06c, not stripped

I noticed that the same thing happens when I try to run it on a Intel processor, using the -m32 option for the compiling step, to produce a 32-bit executable.

alex@debian:~/code$ ./a.out 
Thread 1:

Struct address: 0x804e098
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4

a.out: malloc.c:3096: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Aborted


alex@debian:~/code$ file a.out 
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x9966b205f3f6cd3d3a544ea010608e11346f6f9a, not stripped

However, this does not occur while running the 64-bit executable for the program on Intel.

alex@debian:~/code$ ./a.out 
Thread 1:

Struct address: 0xb42130
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4

Old thread: 

Struct address: 0xb42130
fp.a = 1
fp.b = 2
fp.c = 3
fp.d = 4
alex@debian:~/code$ file a.out 
a.out: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x4bb04ef61287bfe750a37427bb41b8b1578d74e1, not stripped

So, is this a bug in libc/malloc(), or am I doing something wrong? Please tell me if you need more details.

Thanks

Answer 1

You're allocating 1 byte for 4 ints:

bla_thr=  malloc(1);

bla_thr->a=1;
bla_thr->b=2;
bla_thr->c=3;
bla_thr->d=4;

This invokes undefined behaviour so anything can happen. The bug is in your code, not libc. If you allocate enough space with:

bla_thr = malloc(sizeof *bla_thr); // == sizeof(struct bla);

it should work. Don't forget to free() the memory afterwards!