[MiNT] tfork() bug.

["m0n0" <ole@monochrom.net>]

Hello there,

I recently found out the MiNT way of doing preemptive tasks. The function
is tfork() in MiNTlib. It can be implemented in you own source anyway.

I think I've found an bug.

within tfork() (mintlib/mintlib/thread.c) there is:

b = (BASEPAGE *)Pexec(PE_CBASEPAGE, 0L, "", 0L);
...
pid = Pexec(104, 0L, b, 0L);
...
(void)Mfree(b->p_env);  /* free the memory */


Within startup() (also within thread.c) there is:

/* If this is a thread, it doesn't need
* own copy of the environment, right?
*/
Mfree(b->p_env);
b->p_env = _base->p_env;

As far as I understand, we have 2 bugs here.

1. Double free()
   tfork() and startup() call free() on the same environment pointer.

2. Race condition
   If the thread was already running, and gave back the execution to the
   parent, the p_env will point to the parent environment and tfork() will
   free it's own environment.

Can somebody confirm this bug and that I understand it correctly?

-- 
Greets,
Ole