Failure INSIDE malloc() ??

[Bradley K. Sherman]

C programs that do a lot of mapping between 1 based entities (screen
positions, page layouts, etc.) and internal 0 based arrays often have
code that looks something like:

	Yarra = malloc( MAXCOLS );
	...

	foo( row, col, otherstuff )
	{
	   ...
	   Yarra[col - 1] = something;
	   ...
	}

Now, exactly where to do the 1 to 0 mapping is not always clear and
sometimes, especially early in program development, it is done twice!
If "col" started out as 1 in this example and had already been converted
to 0 earlier in the program then the statement above will access Yarra[-1].

The result of accessing the minus-first element of a malloc'ed array
is implementation dependent, but if it doesn't core-dump immediately
you are in for one hell of a search for this bug when it does make
its presence known.  Doing this using the MSC compiler on MessyDos
can produce some real consciousness raising effects.

---------------------------------
	Brad Sherman (bks at alfa.berkeley.edu)
myjob( bug ){ fix(bug); done() ? fired() : myjob(getbug()); }