Microsoft KB Archive/225099

= FIX: Access violation when you use the Realloc function in a small memory block in Visual C++ 6.0 =

Article ID: 225099

Article Last Modified on 8/7/2007

-

APPLIES TO


 * The C Run-Time (CRT), when used with:
 * Microsoft Visual C++ 6.0 Service Pack 5

-



This article was previously published under Q225099



SYMPTOMS
Under certain circumstances, using the Realloc function in a small memory block (if the total small-block memory pool exceeds 16 MB) causes access violation with the Visual C++ 6.0 small-block allocator.



CAUSE
Memory access violation occurs inside the __sbh_free_block function due to a bug in the implementation of the _realloc_base function.



RESOLUTION
Here are three ways to work around this problem:   In the following code block in the Realloc.c file: // if the new size is not over __sbh_threshold, attempt // to reallocate within the small-block heap if (newsize <= __sbh_threshold) {  if (__sbh_resize_block(pHeader, pBlock, newsize)) pvReturn = pBlock; else if ((pvReturn = __sbh_alloc_block(newsize)) != NULL) {     oldsize = ((PENTRY)((char *)pBlock - sizeof(int)))->sizeFront - 1; memcpy(pvReturn, pBlock, __min(oldsize, newsize)); __sbh_free_block(pHeader, pBlock); } } Replace this line of code: __sbh_free_block(pHeader, pBlock); with this: pHeader = __sbh_find_block(pBlock); __sbh_free_block(pHeader, pBlock); And rebuild CRT. NOTE: If you are rebuilding the DLL version of CRT, then the new DLL name should not start with "msvc".  Implement your own Realloc function to avoid using the CRT implementation. Use the _set_sbh_threshold(0) function to avoid the use of the small block heap. Both Windows NT 4.0 SP4 and Windows 2000 have an efficient OS-level heap implementation. You may encounter performance problems on Windows 95 and Windows 98 because its operating system heap implementation is not as efficient as the one on Windows NT.

A supported fix for the Visual C++ 6.0 static libraries that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

The English version of this fix should have the following file attributes or later:

in the following self-extracting file:

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it is determined that you only require the fix you requested. However, this fee is non-refundable if you request additional technical support, if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support.



STATUS
Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article. This bug was corrected in the next service pack for Visual Studio 6.0.

For additional information about Visual Studio service packs, click the following article numbers to view the articles in the Microsoft Knowledge Base:

194022 INFO: Visual Studio 6.0 Service Packs, What, Where, Why

194295 HOWTO: Tell That a Visual Studio Service Pack Is Installed

To download the latest Visual Studio service pack, visit the following Microsoft Web site:

http://msdn2.microsoft.com/en-us/vstudio/Aa718353.aspx



Steps to Reproduce Behavior
Build the following .cpp file as a console application and run it under the debugger. You receive an access violation error. //main.cpp


 * 1) include "stdio.h"
 * 2) include "stdlib.h"

int main {   char* pData;

for( int i=0; i< 70000; i++ ) {           pData = (char*)malloc( 32 ); pData = (char*)realloc( pData, 290 ); //access violation in small-block allocator }

return(0); } //end main

