bugGNU Octave - Bugs: bug #34808, atexit double free

 
 

bug #34808: atexit double free

Submitter:  None
Submitted:  Sat 12 Nov 2011 02:38:58 AM UTC
   
 
Category:  Interpreter Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  None Assigned to:  None
Originator Name:  Kyle Husmann Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 3.4.3
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 16 Nov 2011 08:11:35 PM UTC, comment #3: 

Ok. I'll close this bug report. If for some reason it needs to reopened come back and leave a comment and I or someone can take care of that.

Thanks.

Ben Abbott <bpabbott>
Group Member
Wed 16 Nov 2011 07:40:56 PM UTC, comment #2: 

Ah, sorry, it appears I'm not using the embedded mode as it was intended. By calling do_octave_exit() before I let my program exit, the problem is fixed.

I had assumed calling do_octave_exit() was unnecessary to call in my code because it was registered with atexit() when octave_main() was called, but I was wrong.

Kyle Husmann <khusmann>
Tue 15 Nov 2011 02:17:59 AM UTC, comment #1: 

Kyle,

I'm not a competent c++ programer, so I can't provide a patch, but I can test one on OSX Lion and Ubuntu.

Are you interested to working on a patch?

Ben Abbott <bpabbott>
Group Member
Sat 12 Nov 2011 02:38:58 AM UTC, original submission:  

I have a program that links to octave. All it does is calls octave_main with embedded = true, nothing else (attached). In Linux it appears to run fine, but on OSX when the program exits, it complains:


a.out(29561) malloc: *** error for object 0x10507c170: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug


This is actually a sign of a deeper problem. The problem is that do_octave_exit() is registered with atexit() by octave_main() (octave.cc:830) BEFORE the static memory in functions like octave_read is initialized. This is a problem, because according to the C++ standard,


3.6.3/3: "If a function is registered with atexit then following the call to exit, any objects with static storage duration initialized prior to the registration of that function shall not be destroyed until the registered function is called from the termination process and has completed. For an object with static storage duration constructed after a function is registered with atexit, then following the call to to exit, the registered function is not called until the execution of the object's destructor has completed. If atexit is called during the construction of an object, the complete object to which it belongs shall be destroyed before the registered function is called."


So, a double free is basically happening. To fix this, I suppose functions like octave_read should be called to initialize their static data BEFORE do_octave_exit() is registered with atexit()

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #24359:  bug.cc added by None (272B - text/x-c++src)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by khusmann (Posted a comment)
  • -email is unavailable- added by bpabbott (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-11-16 bpabbott Open/ClosedOpen Closed
    2011-11-12 None Attached File- Added bug.cc, #24359

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code