MIPS 74kc memory corruption bug

bug.c

/* Compile with: 
 * ./staging_dir/toolchain-mips_24kc_gcc-12.3.0_musl/bin/mips-openwrt-linux-gcc -g -fpie -fpic -o /tmp/bug /tmp/bug.c
 */

#include <stdio.h>
#include <stdbool.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>

const uint8_t input[] = {
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
};


typedef struct {
	uint8_t *mem;
	size_t len;
} buf_t;

#define CHUNK_SIZE 8

static bool add_byte(buf_t *buf, uint8_t byte)
{
	bool rv = true;

	if (buf->len % CHUNK_SIZE == 0) {
		uint8_t *old = NULL;

		if (buf->len) {
			old = calloc(1, buf->len);

			if (!old) {
				fprintf(stderr, "calloc failure\n");
				exit(1);
			}

			memcpy(old, buf->mem, buf->len);
		}

#if 0
		uint8_t *tmp = realloc(buf->mem, buf->len + CHUNK_SIZE);
#else
		uint8_t *tmp = malloc(buf->len + CHUNK_SIZE);

		if (tmp) {
			memcpy(tmp, buf->mem, buf->len);
			free(buf->mem);
		}
#endif

		if (!tmp) {
			fprintf(stderr, "realloc failure\n");
			exit(1);
		}

		buf->mem = tmp;

		if (old && memcmp(old, buf->mem, buf->len) != 0) {
			fprintf(stderr, "MEMORY CORRUPTION???\n\n");
			fprintf(stderr, "OLD MEMORY:");
			for (size_t i = 0; i < buf->len; i++) {
				if (i % 26 == 0) fprintf(stderr, "\n");
				fprintf(stderr, "%02hhx ", old[i]);
			}

			fprintf(stderr, "\n\nNEW MEMORY (different bytes suffixed with !):");
			for (size_t i = 0; i < buf->len; i++) {
				if (i % 26 == 0) fprintf(stderr, "\n");
				fprintf(stderr, "%02hhx%c",
					buf->mem[i],
					buf->mem[i] == old[i] ? ' ' : '!');
			}

			fprintf(stderr, "\n\n");

			rv = false;
		}

		free(old);
	}

	buf->mem[buf->len++] = byte;

	return rv;
}

static bool test(buf_t *buf)
{
	bool ok = true;

	free(buf->mem);
	buf->mem = NULL;
	buf->len = 0;

	for (size_t i = 0; i < sizeof(input); i++)
		ok &= add_byte(buf, input[i]);

	return ok;
}

int main(int argc, char **argv)
{
	buf_t buf = { 0 };
	int runs = 0;

	while (true) {
		runs++;

		if (!test(&buf)) {
			fprintf(stderr, "FINAL MEMORY:");

			for (size_t i = 0; i < buf.len; i++) {
				if (i % 26 == 0) fprintf(stderr, "\n");
				fprintf(stderr, "%02hhx ", buf.mem[i]);
			}

			fprintf(stderr, "\n\nFailure after %d runs\n\n", runs);
			exit(1);
		}
	}

	exit(0);
}

failure.txt

root@luemmel-og:~# /tmp/bug.mips 
MEMORY CORRUPTION???

OLD MEMORY:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 7f ff 00 00 00 00 00 

NEW MEMORY (different bytes suffixed with !):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 7f ff 00 00 80!00 00 

FINAL MEMORY:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 7f ff 00 00 80 00 00 00 

Failure after 1176061 runs

root@luemmel-og:~#