# Heap corruption in win32 compiled by VC

**URL:** <https://www.ruby-forum.com/t/heap-corruption-in-win32-compiled-by-vc/209390>\
**Category:** NGINX\
**Created:** [July 13, 2011, 7:37am UTC](https://www.ruby-forum.com/t/heap-corruption-in-win32-compiled-by-vc/209390 "2011-07-13T07:37:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [July 13, 2011, 7:37am UTC](https://www.ruby-forum.com/t/heap-corruption-in-win32-compiled-by-vc/209390/1 "2011-07-13T07:37:23Z")

</div>

I checkout the newest code from svn and compiled it by vc, but an  
exception occurred. So I modified cl option to -MTd compiled again.  
The windbg shows that CheckBytes function return false when calling  
ngx\_free() at ngx\_shmem.c:43.

I think that ngx\_sprintf must put more than name’s alloc size bytes into  
name, So I use ngx\_snprintf to replace ngx\_sprintf. The problem  
disappeared. Is it useful?

```
name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN),

```

shm-\>log);  
if (name == NULL) {  
return NGX\_ERROR;  
}

- (void) ngx\_sprintf(name, “%V\_%s%Z”, &shm-\>name, ngx\_unique);

- (void) ngx\_snprintf(name, shm-\>name.len + 2 +  
sizeof(NGX\_INT32\_LEN),
- 

```
                               "%V_%s%Z", &shm->name, ngx_unique);

```

Posted at Nginx Forum:

> **[Heap corruption in win32 compiled by VC](https://forum.nginx.org/read.php?2,212315,212315#msg-212315)**
>
> I checkout the newest code from svn and compiled it by vc, but an exception occurred. So I modified cl option to -MTd compiled again. The windbg shows that CheckBytes function return false when calling ngx\_free() at ngx\_shmem.c:43. I think that...

---

<div class="post-metadata">

**Author:** ![bigplum](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/7c8e57/32.png) [@bigplum](https://www.ruby-forum.com/u/bigplum)\
**Post date:** [July 13, 2011, 12:59pm UTC](https://www.ruby-forum.com/t/heap-corruption-in-win32-compiled-by-vc/209390/2 "2011-07-13T12:59:13Z")

</div>

Hello!

On Wed, Jul 13, 2011 at 01:36:38AM -0400, bigplum wrote:

> shm-\>log);  
> if (name == NULL) {  
> return NGX\_ERROR;  
> }
> 
> - (void) ngx\_sprintf(name, “%V\_%s%Z”, &shm-\>name, ngx\_unique);
> 
> - (void) ngx\_snprintf(name, shm-\>name.len + 2 +  
> sizeof(NGX\_INT32\_LEN),
> - 
> 
> ```
> "%V_%s%Z", &shm->name, ngx_unique);
> 
> ```

The fact that patch helps suggests that ngx\_unique wasn’t set  
properly. Looks like ./configure problem for me.

(on the other hand, setting ngx\_unique needs more sanity checking  
anyway: looks like it currently just trusts environment if it’s  
found, not a good thing to do)

Maxim D.