_Heap_Walk hates me

[Phil Torre]

I'm having this problem with RTEMS-4.5.0, running on an MPC860, with
RTEMS built as VARIANT=DEBUG and RTEMS_DEBUG defined.

I've got this application code which predictably aborts out while
doing _Heap_Walk() on the malloc heap, sometimes after a malloc() and
sometimes after a free().

_Heap_Walk() is aborting at heapwalk.c:90 because the front and back
flags of a block don't match, sometimes after dumping some stuff like
this:

PASS: 2  Front and back flags don't match
         Current Block (0xffe22c10):  Back - 25,  Front - 32
         Next Block (0xffe22c30):     Back - 56,  Front - 45

Please correct me if I'm wrong, but this doesn't look like the result of
leaking application code, but rather something corrupting the chain of 
heap blocks used by the malloc region.  (If we were freeing something
twice or letting the heap leak away, I'd expect an error return from 
malloc() or free(), but this error seems to mean that the internal state
of the heap region itself has become inconsistent.)

It seems unlikely that the RTEMS heap code is buggy, so it must be us.
Is there something we could be doing (other than scribbling on the heap
data structures through a wild pointer or the like) to cause this lossage?
Thanks in advance...

--

=====================================================================
Phil Torre                               phone: 425-820-6363 x234
Design Engineer                          email: ptorre at zetron.com
Switching Systems Group                    fax: 425-820-7031
Zetron, Inc.                               web: http://www.zetron.com