bugPSPP - Bugs: bug #39097, Invalid memory access in gui vs....

 
 

bug #39097: Invalid memory access in gui vs. vector

Submitter:  John Darrington <jmd>
Submitted:  Tue 28 May 2013 01:22:30 PM UTC
   
 
Category:  Graphical User Interface Severity:  5 - Average
Status:  Fixed Assigned to:  blp
Open/Closed:  Closed Release:  Before 0.8.0
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 13 Jun 2013 07:11:53 AM UTC, comment #8: 

Fixed with commit 3b07fccffef7 "INPUT PROGRAM: Use a separate dataset for the input program."

Ben Pfaff <blp>
Group administrator
Wed 05 Jun 2013 06:48:34 AM UTC, comment #7: 

My solution is progressing, I have a few issues to resolve.

Ben Pfaff <blp>
Group administrator
Tue 04 Jun 2013 06:58:29 AM UTC, comment #6: 

I have an idea for a fairly elegant solution.  I'll work on it (it's too late tonight).

Ben Pfaff <blp>
Group administrator
Tue 04 Jun 2013 06:14:17 AM UTC, comment #5: 

I think that the actual problem here is that the trivial "fast path" in proc_execute(), that is, the conditional statement in that function, is executed when it should not.  The condition needs to be refined to account for a complex input program.

Ben Pfaff <blp>
Group administrator
Fri 31 May 2013 07:55:33 AM UTC, comment #4: 

I suggest the solution to this problem, is to ref count struct vector.


John Darrington <jmd>
Group administrator
Tue 28 May 2013 05:00:35 PM UTC, comment #3: 

Sorry.  I wasn't very clear.  Here's what I do to produce the problem:

1. Use the attached syntax file foo.sps

2. Run psppire under valgrind, and load the file into the syntax editor.  I use the command line:
 libtool --mode=execute valgrind ./src/ui/gui/psppire foo.sps

3. From the syntax editor click Run|All

Valgrind will produce the errors given below.  That happens reliably.

Sometimes a crash will also follow.

(file #28199)

John Darrington <jmd>
Group administrator
Tue 28 May 2013 03:54:45 PM UTC, comment #2: 

What I don't see in this bug report is what you did to cause the problem reported in the original submission.  Is it reproducible?

Ben Pfaff <blp>
Group administrator
Tue 28 May 2013 01:25:18 PM UTC, comment #1: 

This is perhaps related to bug #33260

When executing the syntax posted there. I see random segfaults.
And valgrind reports invalid access.

John Darrington <jmd>
Group administrator
Tue 28 May 2013 01:22:30 PM UTC, original submission:  

 Invalid read of size 4
==8916==    at 0x41B6FF2: vector_get_var_cnt (vector.c:131)
==8916==    by 0x405C088: compute_num_vec (compute.c:146)
==8916==    by 0x41B3D02: trns_chain_execute (transformations.c:197)
==8916==    by 0x40BB152: input_program_casereader_read (inpt-pgm.c:215)
==8916==    by 0x4185314: casereader_read (casereader.c:71)
==8916==    by 0x4184381: buffer_case (casereader-shim.c:88)
==8916==    by 0x41843ED: casereader_shim_read (casereader-shim.c:111)
==8916==    by 0x4185B14: random_reader_read (casereader.c:513)
==8916==    by 0x4185314: casereader_read (casereader.c:71)
==8916==    by 0x41857B0: casereader_advance (casereader.c:304)
==8916==    by 0x41856ED: casereader_count_cases__ (casereader.c:246)
==8916==    by 0x4185730: casereader_count_cases (casereader.c:267)
==8916==  Address 0xd572bb0 is 8 bytes inside a block of size 12 free'd
==8916==    at 0x402850C: free (vg_replace_malloc.c:427)
==8916==    by 0x41B6F56: vector_destroy (vector.c:103)
==8916==    by 0x41956B2: dict_clear_vectors (dictionary.c:1430)
==8916==    by 0x418E3B6: proc_execute (dataset.c:397)
==8916==    by 0x809696F: execute_syntax (executor.c:160)
==8916==    by 0x80BB46B: editor_execute_syntax (psppire-syntax-window.c:257)
==8916==    by 0x80BBB6E: on_run_selection (psppire-syntax-window.c:454)
==8916==    by 0x4C40BEE: g_cclosure_marshal_VOID__VOID (gmarshal.c:85)
==8916==    by 0x4C3EE75: g_closure_invoke (gclosure.c:777)
==8916==    by 0x4C50944: signal_emit_unlocked_R (gsignal.c:3551)
==8916==    by 0x4C58B55: g_signal_emit_valist (gsignal.c:3300)
==8916==    by 0x4C58CD2: g_signal_emit (gsignal.c:3356)
==8916==

John Darrington <jmd>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #28199:  foo.sps added by jmd (154B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by blp (Posted a comment)
  • -email is unavailable- added by jmd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-06-13 blp StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2013-06-04 blp StatusNone In Progress
        Assigned toNone blp
    2013-05-28 jmd Attached File- Added foo.sps, #28199
    2013-05-28 jmd CategoryNone Graphical User Interface
        ReleaseNone Before 0.8.0
        SummaryInvalid memory access in gui. Invalid memory access in gui vs. vector

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code