[Octave-bug-tracker] [bug #63303] test bsxfun.cc-tst coredumps with ASAN

[Dmitri A. Sergatskov]

Follow-up Comment #4, bug #63303 (project octave):

I passes this instance, but now crashes at lsode.cc-tst:

octave:1> test lsode.cc-tst
=================================================================
==655204==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x6020003bf4d0 at pc 0x7f90f423582c bp 0x7f8fd5c38960 sp 0x7f8fd5c38958
WRITE of size 4 at 0x6020003bf4d0 thread T7 (QThread)
    #0 0x7f90f423582b in LSODE::do_integrate(double)
../liboctave/numeric/LSODE.cc:134
    #1 0x7f90f42383c5 in LSODE::do_integrate(ColumnVector const&)
../liboctave/numeric/LSODE.cc:429
    #2 0x7f90f88b89b9 in ODE::integrate(ColumnVector const&)
../liboctave/numeric/ODE.h:92
    #3 0x7f90f88b7191 in octave::Flsode(octave::interpreter&,
octave_value_list const&, int) ../libinterp/corefcn/lsode.cc:395
    #4 0x7f90f7ef6a50 in
octave::tree_evaluator::execute_builtin_function(octave_builtin&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #5 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&, int,
octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #6 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int,
octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #7 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #8 0x7f90f7f48453 in
octave::tree_index_expression::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.h:108
    #9 0x7f90f7ebfc9e in
octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-assign.cc:101
    #10 0x7f90f7efa997 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3940
    #11 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #12 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #13 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #14 0x7f90f7ef88bd in
octave::tree_evaluator::execute_user_function(octave_user_function&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #15 0x7f90f7cc2aa2 in
octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list
const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #16 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&,
int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #17 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #18 0x7f90f7ee1bbc in
octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, bool, int&, int)
../libinterp/parse-tree/pt-eval.cc:1053
    #19 0x7f90f7ee276b in
octave::tree_evaluator::eval(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int)
../libinterp/parse-tree/pt-eval.cc:1112
    #20 0x7f90f87d6447 in
octave::interpreter::eval(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int)
../libinterp/corefcn/interpreter.cc:1512
    #21 0x7f90f7e7f3ab in octave::Feval(octave::interpreter&,
octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430
    #22 0x7f90f7ef6a50 in
octave::tree_evaluator::execute_builtin_function(octave_builtin&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #23 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&,
int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #24 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int,
octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #25 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #26 0x7f90f7f48453 in
octave::tree_index_expression::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.h:108
    #27 0x7f90f7efa997 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3940
    #28 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #29 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #30 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #31 0x7f90f7efc0d8 in
octave::tree_evaluator::visit_try_catch_command(octave::tree_try_catch_command&)
../libinterp/parse-tree/pt-eval.cc:4140
    #32 0x7f90f7f395b4 in
octave::tree_try_catch_command::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-except.h:84
    #33 0x7f90f7efa739 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3915
    #34 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #35 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #36 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #37 0x7f90f7ef9c86 in
octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&)
../libinterp/parse-tree/pt-eval.cc:3788
    #38 0x7f90f7f11750 in
octave::tree_if_command_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-select.h:119
    #39 0x7f90f7ef989d in
octave::tree_evaluator::visit_if_command(octave::tree_if_command&)
../libinterp/parse-tree/pt-eval.cc:3766
    #40 0x7f90f7f5c980 in
octave::tree_if_command::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-select.h:153
    #41 0x7f90f7efa739 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3915
    #42 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #43 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #44 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #45 0x7f90f7efd738 in
octave::tree_evaluator::visit_unwind_protect_command(octave::tree_unwind_protect_command&)
../libinterp/parse-tree/pt-eval.cc:4285
    #46 0x7f90f7f39628 in
octave::tree_unwind_protect_command::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-except.h:151
    #47 0x7f90f7efa739 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3915
    #48 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #49 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #50 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #51 0x7f90f7f155bf in void
octave::tree_evaluator::execute_range_loop<double>(octave::range<double, void>
const&, int, octave::octave_lvalue&, octave::tree_statement_list*)
../libinterp/parse-tree/pt-eval.cc:3049
    #52 0x7f90f7ef337e in
octave::tree_evaluator::visit_simple_for_command(octave::tree_simple_for_command&)
../libinterp/parse-tree/pt-eval.cc:3096
    #53 0x7f90f7f5006a in
octave::tree_simple_for_command::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-loop.h:191
    #54 0x7f90f7efa739 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3915
    #55 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #56 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #57 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #58 0x7f90f7ef88bd in
octave::tree_evaluator::execute_user_function(octave_user_function&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #59 0x7f90f7cc2aa2 in
octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list
const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #60 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&,
int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #61 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #62 0x7f90f7f48453 in
octave::tree_index_expression::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.h:108
    #63 0x7f90f7efa997 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3940
    #64 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #65 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #66 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #67 0x7f90f7ee1555 in
octave::tree_evaluator::eval(std::shared_ptr<octave::tree_statement_list>&,
bool) ../libinterp/parse-tree/pt-eval.cc:985
    #68 0x7f90f7ee0243 in octave::tree_evaluator::repl()
../libinterp/parse-tree/pt-eval.cc:804
    #69 0x7f90f87d50e0 in octave::interpreter::main_loop()
../libinterp/corefcn/interpreter.cc:1350
    #70 0x7f90f87c7b8e in octave::interpreter::execute()
../libinterp/corefcn/interpreter.cc:916
    #71 0x7f90f9a5bfec in octave::interpreter_qobject::execute()
../libgui/src/interpreter-qobject.cc:89
    #72 0x7f90f9d8d844 in
octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call,
int, void**) libgui/src/moc-interpreter-qobject.cc:88
    #73 0x7f90f50d1338 in QObject::event(QEvent*)
(/lib64/libQt5Core.so.5+0x2d1338)
    #74 0x7f90f5dae442 in QApplicationPrivate::notify_helper(QObject*,
QEvent*) (/lib64/libQt5Widgets.so.5+0x1ae442)
    #75 0x7f90f9ba395a in octave::octave_qapplication::notify(QObject*,
QEvent*) ../libgui/src/octave-qobject.cc:148
    #76 0x7f90f50a6be7 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
(/lib64/libQt5Core.so.5+0x2a6be7)
    #77 0x7f90f50aa155 in QCoreApplicationPrivate::sendPostedEvents(QObject*,
int, QThreadData*) (/lib64/libQt5Core.so.5+0x2aa155)
    #78 0x7f90f50f84e6 in postEventSourceDispatch(_GSource*, int (*)(void*),
void*) (/lib64/libQt5Core.so.5+0x2f84e6)
    #79 0x7f90f07280ae in g_main_context_dispatch
(/lib64/libglib-2.0.so.0+0x550ae)
    #80 0x7f90f077d307 in g_main_context_iterate.constprop.0
(/lib64/libglib-2.0.so.0+0xaa307)
    #81 0x7f90f07258a2 in g_main_context_iteration
(/lib64/libglib-2.0.so.0+0x528a2)
    #82 0x7f90f50f7f87 in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(/lib64/libQt5Core.so.5+0x2f7f87)
    #83 0x7f90f50a55f1 in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(/lib64/libQt5Core.so.5+0x2a55f1)
    #84 0x7f90f4ee8349 in QThread::exec() (/lib64/libQt5Core.so.5+0xe8349)
    #85 0x7f90f4ee9545 in QThreadPrivate::start(void*)
(/lib64/libQt5Core.so.5+0xe9545)
    #86 0x7f90f129f821 in start_thread (/lib64/libc.so.6+0x9f821)
    #87 0x7f90f123f44f in clone3 (/lib64/libc.so.6+0x3f44f)

0x6020003bf4d1 is located 0 bytes to the right of 1-byte region
[0x6020003bf4d0,0x6020003bf4d1)
allocated by thread T7 (QThread) here:
    #0 0x7f90fa6b0087 in operator new(unsigned long)
(/lib64/libasan.so.6+0xb0087)
    #1 0x7f90f7cbcdfb in __gnu_cxx::new_allocator<int>::allocate(unsigned
long, void const*) /usr/include/c++/11/ext/new_allocator.h:127
    #2 0x7f90f7cbcbd6 in std::allocator_traits<std::allocator<int>
>::allocate(std::allocator<int>&, unsigned long)
/usr/include/c++/11/bits/alloc_traits.h:464
    #3 0x7f90f7cbc9aa in Array<int, std::allocator<int>
>::ArrayRep::allocate(unsigned long) ../liboctave/array/Array.h:197
    #4 0x7f90f80a6589 in Array<int, std::allocator<int>
>::ArrayRep::ArrayRep(int*, long) ../liboctave/array/Array.h:147
    #5 0x7f90f80a6412 in Array<int, std::allocator<int> >::make_unique()
../liboctave/array/Array.h:219
    #6 0x7f90f80a6333 in Array<int, std::allocator<int> >::elem(long)
../liboctave/array/Array.h:531
    #7 0x7f90f80a6314 in Array<int, std::allocator<int> >::operator()(long)
../liboctave/array/Array.h:543
    #8 0x7f90f42357f1 in LSODE::do_integrate(double)
../liboctave/numeric/LSODE.cc:134
    #9 0x7f90f42383c5 in LSODE::do_integrate(ColumnVector const&)
../liboctave/numeric/LSODE.cc:429
    #10 0x7f90f88b89b9 in ODE::integrate(ColumnVector const&)
../liboctave/numeric/ODE.h:92
    #11 0x7f90f88b7191 in octave::Flsode(octave::interpreter&,
octave_value_list const&, int) ../libinterp/corefcn/lsode.cc:395
    #12 0x7f90f7ef6a50 in
octave::tree_evaluator::execute_builtin_function(octave_builtin&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #13 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&,
int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #14 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int,
octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #15 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #16 0x7f90f7f48453 in
octave::tree_index_expression::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.h:108
    #17 0x7f90f7ebfc9e in
octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-assign.cc:101
    #18 0x7f90f7efa997 in
octave::tree_evaluator::visit_statement(octave::tree_statement&)
../libinterp/parse-tree/pt-eval.cc:3940
    #19 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:124
    #20 0x7f90f7efb4e6 in
octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&)
../libinterp/parse-tree/pt-eval.cc:4025
    #21 0x7f90f7a14000 in
octave::tree_statement_list::accept(octave::tree_walker&)
../libinterp/parse-tree/pt-stmt.h:201
    #22 0x7f90f7ef88bd in
octave::tree_evaluator::execute_user_function(octave_user_function&, int,
octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #23 0x7f90f7cc2aa2 in
octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list
const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #24 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&,
int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #25 0x7f90f7f42e66 in
octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int)
../libinterp/parse-tree/pt-idx.cc:427
    #26 0x7f90f7ee1bbc in
octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, bool, int&, int)
../libinterp/parse-tree/pt-eval.cc:1053
    #27 0x7f90f7ee276b in
octave::tree_evaluator::eval(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int)
../libinterp/parse-tree/pt-eval.cc:1112
    #28 0x7f90f87d6447 in
octave::interpreter::eval(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int)
../libinterp/corefcn/interpreter.cc:1512
    #29 0x7f90f7e7f3ab in octave::Feval(octave::interpreter&,
octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430

Thread T7 (QThread) created by T0 here:
    #0 0x7f90fa656866 in pthread_create (/lib64/libasan.so.6+0x56866)
    #1 0x7f90f4ee8fd4 in QThread::start(QThread::Priority)
(/lib64/libQt5Core.so.5+0xe8fd4)

SUMMARY: AddressSanitizer: heap-buffer-overflow
../liboctave/numeric/LSODE.cc:134 in LSODE::do_integrate(double)
Shadow bytes around the buggy address:
  0x0c048006fe40: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c048006fe50: fa fa fd fd fa fa fd fa fa fa fd fd fa fa 00 00
  0x0c048006fe60: fa fa 01 fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c048006fe70: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c048006fe80: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa fd fd
=>0x0c048006fe90: fa fa 00 00 fa fa 01 fa fa fa[01]fa fa fa fa fa
  0x0c048006fea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006feb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==655204==ABORTING


Dmitri.
-- 



    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?63303>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/