timeliner triggers fatal error in python2.7 under cygwin

[GoogleCodeExporter]

What steps will reproduce the problem?

$ python2.7  /home/Forensic/volatility-read-only/vol.py --profile=Win2003SP2x86 
-f memdump.raw timeliner  --output-file=MEMORY.DMP_timeline2.txt
Volatility Foundation Volatility Framework 2.3.1
Traceback (most recent call last):
  File "/home/Forensic/volatility-read-only/vol.py", line 184, in <module>
      0 [main] python2.7 2240 C:\cygwin\bin\python2.7.exe: *** fatal error - cmalloc would have returned NULL
Hangup 

What is the expected output? What do you see instead?
Partial output file is created, along with a python 2.7 stackdump (attached)

What version of the product are you using? On what operating system?
revision 3545, using python 2.7, under cygwin on Win7x64

Please provide any additional information below.

Original issue reported on code.google.com by johnmcca...@gmail.com on 4 Nov 2013 at 2:14

Attachments:

• python2.7.exe.stackdump

[GoogleCodeExporter]

I just noticed I get the same error from the shimcache plugin, which may be teh 
source of the problem:

$ python2.7  /home/Forensic/volatility-read-only/vol.py --profile=Win2003SP2x86 
-f memdump.raw shimcache
Volatility Foundation Volatility Framework 2.3.1
Traceback (most recent call last):
  File "/home/Forensic/volatility-read-only/vol.py", line 184, in <module>
    197 [main] python2.7 8532 C:\cygwin\bin\python2.7.exe: *** fatal error - cmalloc would have returned NULL
Hangup

Original comment by johnmcca...@gmail.com on 4 Nov 2013 at 5:53

[GoogleCodeExporter]

hrmmm i'm not sure why that should even happen.... it will take me a bit to 
install cygwin and see if i can duplicate.

Original comment by jamie.l...@gmail.com on 8 Nov 2013 at 2:27

[GoogleCodeExporter]

This appears to be an issue in the way that cygwin does memory management.  
Some references are at [1].  There may be a temporary workaround mentioned in 
[2], but that doesn't sound like it's the right way of solving the problem.

It is also possible that the system you're looking at is hitting the memory 
ceiling, in which case it would require us to rework the way the plugins ran to 
use less memory.

For now, I'll run an update of the cygwin library on our build box and produce 
some new binaries for you to test, hopefully within the next week?  Do please 
send me a reminder if I forget though!!!  5:)

[1] http://cygwin.com/ml/cygwin/2011-03/msg00550.html
[2] http://cygwin.com/ml/cygwin/2011-03/msg00332.html

Original comment by mike.auty@gmail.com on 9 Nov 2013 at 10:26

[GoogleCodeExporter]

Hey guys, do we have an update on this issue? Ikelos, you were going to 
generate some test binaries? 

Original comment by michael.hale@gmail.com on 7 Mar 2014 at 4:13

[GoogleCodeExporter]

Installed latest cygwin64 as of today (5/2/2014) on Win7x64 and getting the 
same error trying to run less:

      0 [main] less 12628 c:\cygwin64\bin\less.exe: *** fatal error - cmalloc wo
uld have returned NULL
    417 [main] less 12628 cygwin_exception::open_stackdumpfile: Dumping stack tr
ace to less.exe.stackdump

Original comment by mishk...@gmail.com on 3 May 2014 at 8:43

[GoogleCodeExporter]

Not sure if this is still an issue, if so please file on github: 
https://github.com/volatilityfoundation/volatility/issues

Original comment by jamie.l...@gmail.com on 20 Nov 2014 at 8:27

• Changed state: Done