[sane-devel] Error on Canon CanoScanLiDE20

[Gerhard Jaeger]

Hi,

On Wednesday 08 June 2005 21:46, Steven Palm wrote:
> 
> On Jun 8, 2005, at 1:30 PM, Gerhard Jaeger wrote:
> > On Wednesday 08 June 2005 18:35, Steven Palm wrote:
> >
> >> scanimage(12019) malloc: *** error for object 0x303fe0: double free
> >> scanimage(12019) malloc: *** set a breakpoint in szone_error to debug
> 
> >>
> >> Is this a known issue, or something unique perhaps to MacOS X ?
> >>
> >
> > In the meantime, it is ;)
> > Mattias Ellert already informed me about that issue, although it's
> > currently not clear, where it comes from.
> 
>   Well, if I change the cleanup code for usbDevs in sane_exit() from:
> 
>      for( tmp = usbDevs;  tmp; tmp = usbDevs->next ) {
>          free( usbDevs );
>          usbDevs = tmp;
>      }
> 
>   to:
> 
>      for( tmp = usbDevs;  tmp; ) {
>          tmp = usbDevs->next;
>          free( usbDevs );
>          usbDevs = tmp;
>      }
> 
>   It eliminates the double-free malloc error, so the backend runs  
> cleanly without the error.

Hmmm, guess you are correct, as in my code, the address of usbDevs is
dereferenced after being freed :( That's done in the for() loop.
I also guess, that this is the cause of a long searched memory leak AND
highly system dependent, as here on my Linux box I couldn't trigger that.

The better code should be:
while( usbDevs ) {
	tmp = usbDevs->next;
	free(usbDevs);
	usbDevs = tmp;
}

I'll change that - thanks for investigating...

> 
>   However, instead of scanning the whole page I get just a small  
> corner. I wonder if endian issues are at play here with the image  
> size the scanner is told to scan?

If you simply call scanimage to scan, the default vals will
be used and these are only some mm of the whole area...

Ciao,
Gerhard