bugGNU Octave - Bugs: bug #47914, segfault with OpenGL patches and...

 
 

bug #47914: segfault with OpenGL patches and address sanitizer

Submitted by:  Rik <rik5>
Submitted on:  Fri 13 May 2016 05:43:26 PM UTC  
 
Category:  Plotting with OpenGL Severity:  4 - Important
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Works For Me Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  dev Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Mon 04 Sep 2017 04:53:54 AM UTC, comment #20: 

I just did 'rundemos' on scripts/plot/(draw|appearance/utils) and using ASAN options

setenv ASAN_OPTIONS "leak_check_at_exit=0:verbose=1"

and there were no memory leaks or segfaults.  I'm going to close this bug and a new one can be opened new leaks are found.

Rik <rik5>
Project Administrator
Sun 03 Sep 2017 03:46:01 PM UTC, comment #19: 

I'm pretty certain now this is a bug in the SW renderer.  I ran the development version recently and the stack trace showed that the problem was with disabling clip planes.

  opengl_renderer::set_clipping (bool enable)
  {
#if defined (HAVE_OPENGL)

    bool has_clipping = (glIsEnabled (GL_CLIP_PLANE0) == GL_TRUE);

    if (enable != has_clipping)
      {
        if (enable)
          for (int i = 0; i < 6; i++)
            glEnable (GL_CLIP_PLANE0+i);
        else
          for (int i = 0; i < 6; i++)
            glDisable (GL_CLIP_PLANE0+i);
      }

I used printf debug statements to find that it was the very first call to

  glDisable (GL_CLIP_PLANE0+i);  // i = 0

which was causing the heap-buffer-overflow.

I get this only when I have set LIBGL_ALWAYS_SOFTWARE to 1.  If I unset this environment variable then the ASAN error goes away.

Rik <rik5>
Project Administrator
Mon 29 Aug 2016 10:18:22 PM UTC, comment #18: 

Hi,

I'm a random octave user, and I am finding this in my own C++ applications when compiled with ubsan. I have the same backtrace (different symbol position, but same ubsan error and stack depth).

I found this bug when searching for the crash message - perhaps this is indeed a problem with the video driver...

I'm using debian testing (x86_64), octave 4.0.3-1, as a virtualbox guest (4.3.30 r101610).

I've fired off a rebuild of the octave package with ubsan enabled, but it looks like it might take a while - I'll get back when I have a test package.

$ glxinfo |head -n 60
libGL error: pci id for fd 4: 80ee:beef, driver (null)
OpenGL Warning: Failed to connect to host. Make sure 3D acceleration is enabled for this VM.
libGL error: core dri or dri2 extension not found
libGL error: failed to load driver: vboxvideo
name of display: :0.0
display: :0  screen: 0
direct rendering: Yes
server glx vendor string: SGI
server glx version string: 1.4
server glx extensions:
    GLX_ARB_multisample, GLX_EXT_import_context, GLX_EXT_texture_from_pixmap,
    GLX_EXT_visual_info, GLX_EXT_visual_rating, GLX_MESA_copy_sub_buffer,
    GLX_OML_swap_method, GLX_SGIS_multisample, GLX_SGIX_fbconfig,
    GLX_SGIX_pbuffer, GLX_SGI_make_current_read
client glx vendor string: Mesa Project and SGI
client glx version string: 1.4
client glx extensions:
    GLX_ARB_create_context, GLX_ARB_create_context_profile,
    GLX_ARB_create_context_robustness, GLX_ARB_fbconfig_float,
    GLX_ARB_framebuffer_sRGB, GLX_ARB_get_proc_address, GLX_ARB_multisample,
    GLX_EXT_buffer_age, GLX_EXT_create_context_es2_profile,
    GLX_EXT_create_context_es_profile, GLX_EXT_fbconfig_packed_float,
    GLX_EXT_framebuffer_sRGB, GLX_EXT_import_context,
    GLX_EXT_texture_from_pixmap, GLX_EXT_visual_info, GLX_EXT_visual_rating,
    GLX_INTEL_swap_event, GLX_MESA_copy_sub_buffer,
    GLX_MESA_multithread_makecurrent, GLX_MESA_query_renderer,
    GLX_MESA_swap_control, GLX_OML_swap_method, GLX_OML_sync_control,
    GLX_SGIS_multisample, GLX_SGIX_fbconfig, GLX_SGIX_pbuffer,
    GLX_SGIX_visual_select_group, GLX_SGI_make_current_read,
    GLX_SGI_swap_control, GLX_SGI_video_sync
GLX version: 1.4
GLX extensions:
    GLX_ARB_get_proc_address, GLX_ARB_multisample, GLX_EXT_import_context,
    GLX_EXT_texture_from_pixmap, GLX_EXT_visual_info, GLX_EXT_visual_rating,
    GLX_MESA_copy_sub_buffer, GLX_MESA_multithread_makecurrent,
    GLX_MESA_query_renderer, GLX_OML_swap_method, GLX_SGIS_multisample,
    GLX_SGIX_fbconfig, GLX_SGIX_pbuffer, GLX_SGI_make_current_read
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: VMware, Inc. (0xffffffff)
    Device: llvmpipe (LLVM 3.8, 128 bits) (0xffffffff)
    Version: 11.2.2
    Accelerated: no
    Video memory: 2971MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 3.3
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: VMware, Inc.
OpenGL renderer string: Gallium 0.4 on llvmpipe (LLVM 3.8, 128 bits)
OpenGL version string: 3.0 Mesa 11.2.2
OpenGL shading language version string: 1.30
OpenGL context flags: (none)
OpenGL extensions:
    GL_AMD_conservative_depth, GL_AMD_draw_buffers_blend,
    GL_AMD_seamless_cubemap_per_texture, GL_AMD_shader_stencil_export,
    GL_AMD_shader_trinary_minmax, GL_ANGLE_texture_compression_dxt3,
    GL_ANGLE_texture_compression_dxt5, GL_APPLE_packed_pixels,
    GL_APPLE_vertex_array_object, GL_ARB_ES2_compatibility,
    GL_ARB_ES3_compatibility, GL_ARB_arrays_of_arrays, GL_ARB_base_instance,
    GL_ARB_blend_func_extended, GL_ARB_buffer_storage,
    GL_ARB_clear_buffer_object, GL_ARB_clip_control,
    GL_ARB_color_buffer_float, GL_ARB_compressed_texture_pixel_storage,

Person <mycae>
Fri 29 Jul 2016 10:09:14 PM UTC, comment #17: 

Still failing with the patch.  Here is the traceback I see from the address sanitizer:

octave:1> demo patch 2
patch example 2:
%% Unclosed patch
clf;
t1 = (1/16:1/8:1)' * 2*pi;
t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
x1 = sin (t1) - 0.8;
y1 = cos (t1);
x2 = sin (t2) + 0.8;
y2 = cos (t2);
patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

octave:2> =================================================================
==32698==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002c77c0 at pc 0x7f1ab9d27445 bp 0x7ffd298c6000 sp 0x7ffd298c57b0
READ of size 68 at 0x6180002c77c0 thread T0
    #0 0x7f1ab9d27444 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x88444)
    #1 0x7f1a8199b0b3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3370b3)
    #2 0x7f1a819a222f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33e22f)
    #3 0x7f1a819a15b9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33d5b9)
    #4 0x7f1a8199ef3d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33af3d)
    #5 0x7f1a8199ffe3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33bfe3)
    #6 0x7f1a81a7ae34  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x416e34)
    #7 0x7f1a81a7b0ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x4170ce)
    #8 0x7f1a819af548  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x34b548)
    #9 0x7f1a819a8114  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x344114)
    #10 0x7f1a819a8638  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x344638)
    #11 0x7f1a81cc3b0e  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x65fb0e)
    #12 0x7f1a8186194e  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1fd94e)
    #13 0x7f1a81833643  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1cf643)
    #14 0x7f1a8181f2eb  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1bb2eb)
    #15 0x7f1a81830422  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1cc422)
    #16 0x7f1a8173bf18  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xd7f18)
    #17 0x7f1ab8985b18 in opengl_renderer::draw_axes_children(axes::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:1735
    #18 0x7f1ab898663e in opengl_renderer::draw_axes(axes::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:1817
    #19 0x7f1ab897c633 in opengl_renderer::draw(graphics_object const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:660
    #20 0x7f1ab98c9479 in opengl_renderer::draw(Matrix const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.h:52
    #21 0x7f1ab897daed in opengl_renderer::draw_figure(figure::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:730
    #22 0x7f1ab897c535 in opengl_renderer::draw(graphics_object const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:658
    #23 0x7f1ab98a3f3f in QtHandles::GLCanvas::draw(octave_handle const&) /home/jwe/src/octave/libgui/graphics/GLCanvas.cc:63
    #24 0x7f1ab98878dd in QtHandles::Canvas::canvasPaintEvent() /home/jwe/src/octave/libgui/graphics/Canvas.cc:319
    #25 0x7f1ab98a453d in QtHandles::GLCanvas::paintGL() /home/jwe/src/octave/libgui/graphics/GLCanvas.cc:144
    #26 0x7f1ab47672a4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2a4)
    #27 0x7f1ab4766d5c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd5c)
    #28 0x7f1ab3c6512f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x21b12f)
    #29 0x7f1ab4770760 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x36760)
    #30 0x7f1ab3c0e90b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c490b)
    #31 0x7f1ab3c15845 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cb845)
    #32 0x7f1ab36e28fc in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a8fc)
    #33 0x7f1ab3c5f796 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x215796)
    #34 0x7f1ab3e2f0bc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e50bc)
    #35 0x7f1ab3c52456 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x208456)
    #36 0x7f1ab3c65217 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x21b217)
    #37 0x7f1ab4770760 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x36760)
    #38 0x7f1ab3c0e90b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c490b)
    #39 0x7f1ab3c15845 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cb845)
    #40 0x7f1ab36e28fc in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a8fc)
    #41 0x7f1ab36e63b5 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e3b5)
    #42 0x7f1ab37130a2  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb0a2)
    #43 0x7f1aac872fd6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49fd6)
    #44 0x7f1aac87322f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a22f)
    #45 0x7f1aac8732db in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2db)
    #46 0x7f1ab37131f3 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1f3)
    #47 0x7f1ab3cb89d5  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26e9d5)
    #48 0x7f1ab36e117e in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18917e)
    #49 0x7f1ab36e14e4 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1894e4)
    #50 0x7f1ab36e74a8 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f4a8)
    #51 0x7f1ab97bc4e9 in octave::gui_application::execute() /home/jwe/src/octave/libgui/src/octave-gui.cc:227
    #52 0x401ebb in main /home/jwe/src/octave/src/main-gui.cc:104
    #53 0x7f1ab4fb572f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2072f)
    #54 0x4018f8 in _start (/scratch/jwe/build/octave-asan/src/.libs/lt-octave-gui+0x4018f8)

0x6180002c77c0 is located 0 bytes to the right of 832-byte region [0x6180002c7480,0x6180002c77c0)
allocated by thread T0 here:
    #0 0x7f1ab9d32f4a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x93f4a)
    #1 0x7f1a81a7aab7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x416ab7)

John W. Eaton <jwe>
Project Administrator
Thu 28 Jul 2016 04:45:55 PM UTC, comment #16: 

That error might be caused by the current implementation of lights. On one of my systems, the constant GL_MAX_LIGHTS is way too high. I am not sure what happens in the following lines when "i" increases way too far:

  // disable other OpenGL lights
  for (int i = num_lights; i < GL_MAX_LIGHTS; i++)
    glDisable (GL_LIGHT0 + i);

A fix for this is contained in file #37999 in patch #8943.

It might also be completely unrelated but comment #14 rang a bell to me.

Markus M├╝tzel <mmuetzel>
Project Member
Thu 28 Jul 2016 12:53:32 PM UTC, comment #15: 

BTW, I also see that this error happens if I set graphics_toolkit to fltk, so it seems more like a bug in OpenGL an error in the way we are calling OpenGL routines rather than memory corruption caused by threading in the Qt graphics code.

John W. Eaton <jwe>
Project Administrator
Thu 28 Jul 2016 06:27:40 AM UTC, comment #14: 

Oh, I see.  That also causes a crash for me.  The traceback I get says that it is happening in the function call

glDisable (GL_DEPTH_TEST);

in opengl_renderer::draw_axes_children.

John W. Eaton <jwe>
Project Administrator
Thu 28 Jul 2016 06:14:04 AM UTC, comment #13: 

I can reproduce this problem if i set LIBGL_ALWAYS_SOFTWARE=1:

ASAN_OPTIONS=alloc_dealloc_mismatch=0 LIBGL_ALWAYS_SOFTWARE=1 ./run-octave --no-gui

octave:1> demo patch 2
patch example 2:
 %% Unclosed patch
 clf;
 t1 = (1/16:1/8:1)' * 2*pi;
 t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
 x1 = sin (t1) - 0.8;
 y1 = cos (t1);
 x2 = sin (t2) + 0.8;
 y2 = cos (t2);
 patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

octave:2> =================================================================
==22330==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160004418c0 at pc 0x7fd08ca29ccf bp 0x7ffe8b3cd320 sp 0x7ffe8b3ccac8
READ of size 52 at 0x6160004418c0 thread T0
    #0 0x7fd08ca29cce  (/lib64/libasan.so.3+0x5ecce)
    #1 0x7fd0576d9d23  (/usr/lib64/dri/swrast_dri.so+0x36bd23)
....
SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.3+0x5ecce)
Shadow bytes around the buggy address:
  0x0c2c800802c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800802d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c800802e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c800802f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c80080300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c80080310: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c2c80080320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80080330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22330==ABORTING

Dmitri A. Sergatskov <dasergatskov>
Thu 28 Jul 2016 04:10:41 AM UTC, comment #12: 

I can't duplicate this problem either.  I compiled with the address sanitizer options and default compiler flags and also "-O0 -ggdb3" and I did not see a crash.  Memory leaks were reported when I exited Octave, but that's it.

Also, I still can't start the GUI when compiling with the sanitizer flags.

Maybe this is just buggy OpenGL drivers or libraries?  I don't know what we can do about that.  I have the following:

$ glxinfo -B
name of display: :0
display: :0  screen: 0
direct rendering: Yes
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: X.Org (0x1002)
    Device: AMD RS880 (DRM 2.43.0, LLVM 3.7.1) (0x9715)
    Version: 11.1.1
    Accelerated: yes
    Video memory: 512MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 3.3
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: X.Org
OpenGL renderer string: Gallium 0.4 on AMD RS880 (DRM 2.43.0, LLVM 3.7.1)
OpenGL core profile version string: 3.3 (Core Profile) Mesa 11.1.1
OpenGL core profile shading language version string: 3.30
OpenGL core profile context flags: (none)
OpenGL core profile profile mask: core profile

OpenGL version string: 3.0 Mesa 11.1.1
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

OpenGL ES profile version string: OpenGL ES 3.0 Mesa 11.1.1
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.00

John W. Eaton <jwe>
Project Administrator
Tue 12 Jul 2016 08:08:18 PM UTC, comment #11: 

changeset:   22099:4c0f78b3c86f

I cannot complete the doc build if I compile with -fsanitize=address ; there are too many leaks building voronoi.txt.
It gives up with
SUMMARY: AddressSanitizer: 126332 byte(s) leaked in 2675 allocation(s).
Makefile:27702: recipe for target 'doc/interpreter/voronoi.txt' failed

(I had to set  ASAN_OPTIONS=new_delete_type_mismatch=0 or I get
SUMMARY: AddressSanitizer: new-delete-type-mismatch (/lib64/libasan.so.3+0xc8b60) in operator delete(void*, unsigned long)
)

I could run
ASAN_OPTIONS=new_delete_type_mismatch=0 ./run-octave --no-gui
and execute 'demo patch 2" w/ no problem after that)

This is on ccomputer with nvidia card:

glxinfo -B
name of display: :0
display: :0  screen: 0
direct rendering: Yes
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: nouveau (0x10de)
    Device: NVC3 (0xdd8)
    Version: 11.2.2
    Accelerated: yes
    Video memory: 995MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 4.1
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: nouveau
OpenGL renderer string: Gallium 0.4 on NVC3
OpenGL core profile version string: 4.1 (Core Profile) Mesa 11.2.2 (git-5de088f)
OpenGL core profile shading language version string: 4.10
OpenGL core profile context flags: (none)
OpenGL core profile profile mask: core profile

OpenGL version string: 3.0 Mesa 11.2.2 (git-5de088f)
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

OpenGL ES profile version string: OpenGL ES 3.0 Mesa 11.2.2 (git-5de088f)
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.00

Please tell me if I am doing something wrong. I will try on different  hardware later today.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Tue 12 Jul 2016 05:39:05 PM UTC, comment #10: 

Very possible.

Anyways, I tested with regular -O2 options and it still crashes.

Rik <rik5>
Project Administrator
Tue 12 Jul 2016 05:24:57 PM UTC, comment #9: 

It might also be the mesa driver for your particular system, or the version of mesa, since I see swrast_dri.so at the top of the stack where the buffer overflow is reported.

Mike Miller <mtmiller>
Project Administrator
Tue 12 Jul 2016 05:19:03 PM UTC, comment #8: 

It might be my version of gcc (Ubuntu 5.2.1-22ubuntu2) among other things.

Rik <rik5>
Project Administrator
Tue 12 Jul 2016 05:09:57 PM UTC, comment #7: 

This still fails for me with cset 5ad67277b007.  This is a debug version so I am setting '-O0 -g' in the flags.  I'll try again with a regular build to see if optimizations stop the segfault.

demo patch 2
patch example 2:
%% Unclosed patch
clf;
t1 = (1/16:1/8:1)' * 2*pi;
t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
x1 = sin (t1) - 0.8;
y1 = cos (t1);
x2 = sin (t2) + 0.8;
y2 = cos (t2);
patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

=================================================================
==16388==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002dafc0 at pc 0x7f2a6837ed95 bp 0x7ffe847f0ac0 sp 0x7ffe847f0268
READ of size 68 at 0x6180002dafc0 thread T0
    #0 0x7f2a6837ed94 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cd94)
    #1 0x7f2a3ad8fbf3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x30ebf3)
    #2 0x7f2a3ad96d6f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x315d6f)
    #3 0x7f2a3ad960f9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3150f9)
    #4 0x7f2a3ad93a7d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x312a7d)
    #5 0x7f2a3ad94b23  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x313b23)
    #6 0x7f2a3ae69034  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e8034)
    #7 0x7f2a3ae692b5  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e82b5)
    #8 0x7f2a3ada4018  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x323018)
    #9 0x7f2a3ad9cc44  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31bc44)
    #10 0x7f2a3ad9d168  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31c168)
    #11 0x7f2a3b0842ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x6032ce)
    #12 0x7f2a3ac59bde  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1d8bde)
    #13 0x7f2a3ac2d989  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1ac989)
    #14 0x7f2a3ac1421b  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x19321b)
    #15 0x7f2a3ac2a7d2  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1a97d2)
    #16 0x7f2a3ab38769  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xb7769)
    #17 0x7f2a66f7faa6 in opengl_renderer::draw_axes_children(axes::properties const&) libinterp/corefcn/gl-render.cc:1695
    #18 0x7f2a66f80724 in opengl_renderer::draw_axes(axes::properties const&) libinterp/corefcn/gl-render.cc:1777
    #19 0x7f2a66f7607b in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:630
    #20 0x7f2a67f5e50a in opengl_renderer::draw(Matrix const&, bool) libinterp/corefcn/gl-render.h:52
    #21 0x7f2a66f777c1 in opengl_renderer::draw_figure(figure::properties const&) libinterp/corefcn/gl-render.cc:700
    #22 0x7f2a66f75f7a in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:628
    #23 0x7f2a67f350ce in QtHandles::GLCanvas::draw(octave_handle const&) libgui/graphics/GLCanvas.cc:63
    #24 0x7f2a67f160a8 in QtHandles::Canvas::canvasPaintEvent() libgui/graphics/Canvas.cc:319
    #25 0x7f2a67f35701 in QtHandles::GLCanvas::paintGL() libgui/graphics/GLCanvas.cc:144
    #26 0x7f2a6300f2e4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2e4)
    #27 0x7f2a6300ed9c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd9c)
    #28 0x7f2a62509e1f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218e1f)
    #29 0x7f2a630187a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #30 0x7f2a624b5cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #31 0x7f2a624bcc15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #32 0x7f2a61f8985c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #33 0x7f2a62504476 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x213476)
    #34 0x7f2a626d6bfc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e5bfc)
    #35 0x7f2a624f7116 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x206116)
    #36 0x7f2a62509f07 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218f07)
    #37 0x7f2a630187a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #38 0x7f2a624b5cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #39 0x7f2a624bcc15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #40 0x7f2a61f8985c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #41 0x7f2a61f8d315 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e315)
    #42 0x7f2a61fba07d  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb07d)
    #43 0x7f2a5ad91ff6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49ff6)
    #44 0x7f2a5ad9224f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a24f)
    #45 0x7f2a5ad922fb in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2fb)
    #46 0x7f2a61fba1ed in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1ed)
    #47 0x7f2a62560c25  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26fc25)
    #48 0x7f2a61f880d0 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1890d0)
    #49 0x7f2a61f88444 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x189444)
    #50 0x7f2a61f8e428 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f428)
    #51 0x7f2a67e40de9 in octave::gui_application::execute() libgui/src/octave-gui.cc:224
    #52 0x401fb8 in main src/main-gui.cc:104
    #53 0x7f2a63d82abf in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #54 0x401998 in _start (/home/rik/wip/Projects_Mine/octave-dbg/src/.libs/lt-octave-gui+0x401998)

0x6180002dafc0 is located 0 bytes to the right of 832-byte region [0x6180002dac80,0x6180002dafc0)
allocated by thread T0 here:
    #0 0x7f2a6838a9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f2a3ae68cb7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e7cb7)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c30800535a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c30800535f0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c3080053600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080053610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==16388==ABORTING

Rik <rik5>
Project Administrator
Tue 12 Jul 2016 05:02:59 PM UTC, comment #6: 

I build with the following configure options for gcc's address sanitizer:

../configure -C --build=x86_64-linux --with-blas=blas \
  --disable-java --enable-address-sanitizer-flags \
  "CFLAGS=-O0 -ggdb3" \
  "CXXFLAGS=-O0 -ggdb3" \
  "FFLAGS=-O0 -ggdb3"

I get many leaks detected, but no heap-buffer-overflow.

Mike Miller <mtmiller>
Project Administrator
Tue 12 Jul 2016 01:10:59 PM UTC, comment #5: 

I checked that "-fsanitize=address" was properly added in the config.log but still, after rebuilding, I couldn't trigger the heap-buffer-overflow by simply running "demo patch 2". Anything more I should do?

Pantxo Diribarne <pantxo>
Project Member
Tue 12 Jul 2016 12:18:30 PM UTC, comment #4: 

Sorry, spoke too soon ... I copied the configure option from comment #1 and ran "make" without checking the config log. Actually it should be "--enable-address-sanitizer-flags". Rebuilding now.

Pantxo Diribarne <pantxo>
Project Member
Tue 12 Jul 2016 11:49:28 AM UTC, comment #3: 

@Rik: I tried to reproduce this but I am not sure about the way to go. I configured octave with "../octave/configure --enable-address-sanitizer" and then rebuilt the default branch. Simply running the demo after "./run-octave -f --no-gui" is not enough to trigger a bug. Is there any flag we must pass to run-octave in order to enable the address checking? Should I run octave from gdb?

Pantxo Diribarne <pantxo>
Project Member
Fri 13 May 2016 06:22:15 PM UTC, comment #2: 

I'm guessing that they are related.  Why don't you file a separate bug report about that, and then we can link it as a dependency of this report.

Rik <rik5>
Project Administrator
Fri 13 May 2016 06:14:19 PM UTC, comment #1: 

Talking about sanitizing and patch:
patch() doesn't check input sufficiently rigorously.
In case of "patch ('vertices', f, 'faces', ...)" calls, when f contains NaN rows, Octave segfaults (very) hard.  Should I file a separate bug report for that?

Philip Nienhuis <philipnienhuis>
Project Member
Fri 13 May 2016 05:43:26 PM UTC, original submission:  

When Octave has been configured with the --enable-address-sanitizer option, the second patch demo causes a segmentation violation.  The log is shown below.

>> clf;
>>  t1 = (1/16:1/8:1)' * 2*pi;
>>  t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
>>  x1 = sin (t1) - 0.8;
>>  y1 = cos (t1);
>>  x2 = sin (t2) + 0.8;
>>  y2 = cos (t2);
>> patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');
>>
=================================================================
==13896==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002ae7c0 at pc 0x7f1f009ded95 bp 0x7ffef2b046b0 sp 0x7ffef2b03e58
READ of size 68 at 0x6180002ae7c0 thread T0
    #0 0x7f1f009ded94 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cd94)
    #1 0x7f1ed1fabbf3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x30ebf3)
    #2 0x7f1ed1fb2d6f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x315d6f)
    #3 0x7f1ed1fb20f9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3150f9)
    #4 0x7f1ed1fafa7d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x312a7d)
    #5 0x7f1ed1fb0b23  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x313b23)
    #6 0x7f1ed2085034  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e8034)
    #7 0x7f1ed20852b5  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e82b5)
    #8 0x7f1ed1fc0018  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x323018)
    #9 0x7f1ed1fb8c44  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31bc44)
    #10 0x7f1ed1fb9168  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31c168)
    #11 0x7f1ed22a02ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x6032ce)
    #12 0x7f1ed1e75bde  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1d8bde)
    #13 0x7f1ed1e49989  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1ac989)
    #14 0x7f1ed1e3021b  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x19321b)
    #15 0x7f1ed1e467d2  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1a97d2)
    #16 0x7f1ed1d54769  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xb7769)
    #17 0x7f1efeeca0d7 in opengl_renderer::draw_axes_children(axes::properties const&) libinterp/corefcn/gl-render.cc:1571
    #18 0x7f1efeecab2d in opengl_renderer::draw_axes(axes::properties const&) libinterp/corefcn/gl-render.cc:1645
    #19 0x7f1efeec10b9 in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:620
    #20 0x7f1f004c7018 in opengl_renderer::draw(Matrix const&, bool) libinterp/corefcn/gl-render.h:52
    #21 0x7f1efeec2587 in opengl_renderer::draw_figure(figure::properties const&) libinterp/corefcn/gl-render.cc:675
    #22 0x7f1efeec0fb8 in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:618
    #23 0x7f1f0049e78c in QtHandles::GLCanvas::draw(octave_handle const&) libgui/graphics/GLCanvas.cc:67
    #24 0x7f1f0047f002 in QtHandles::Canvas::canvasPaintEvent() libgui/graphics/Canvas.cc:319
    #25 0x7f1f0049edab in QtHandles::GLCanvas::paintGL() libgui/graphics/GLCanvas.cc:148
    #26 0x7f1ef9da32e4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2e4)
    #27 0x7f1ef9da2d9c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd9c)
    #28 0x7f1ef929de1f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218e1f)
    #29 0x7f1ef9dac7a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #30 0x7f1ef9249cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #31 0x7f1ef9250c15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #32 0x7f1ef8d1d85c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #33 0x7f1ef9298476 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x213476)
    #34 0x7f1ef946abfc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e5bfc)
    #35 0x7f1ef928b116 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x206116)
    #36 0x7f1ef929df07 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218f07)
    #37 0x7f1ef9dac7a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #38 0x7f1ef9249cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #39 0x7f1ef9250c15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #40 0x7f1ef8d1d85c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #41 0x7f1ef8d21315 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e315)
    #42 0x7f1ef8d4e07d  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb07d)
    #43 0x7f1ef1fdbff6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49ff6)
    #44 0x7f1ef1fdc24f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a24f)
    #45 0x7f1ef1fdc2fb in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2fb)
    #46 0x7f1ef8d4e1ed in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1ed)
    #47 0x7f1ef92f4c25  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26fc25)
    #48 0x7f1ef8d1c0d0 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1890d0)
    #49 0x7f1ef8d1c444 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x189444)
    #50 0x7f1ef8d22428 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f428)
    #51 0x7f1f003b3a4c in octave_start_gui(int, char**, bool) libgui/src/octave-gui.cc:198
    #52 0x403b0d in main src/main-gui.cc:106
    #53 0x7f1efa5f0a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #54 0x4035f8 in _start (/home/rik/wip/Projects_Mine/octave-dbg/src/.libs/lt-octave-gui+0x4035f8)

0x6180002ae7c0 is located 0 bytes to the right of 832-byte region [0x6180002ae480,0x6180002ae7c0)
allocated by thread T0 here:
    #0 0x7f1f009ea9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f1ed2084cb7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e7cb7)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c308004dca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c308004dcf0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c308004dd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c308004dd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==13896==ABORTING

Rik <rik5>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mycae (Posted a comment)
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by jwe (Posted a comment)
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by mtmiller (Posted a comment)
  • -email is unavailable- added by pantxo (Posted a comment)
  • -email is unavailable- added by rik5 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-09-04 rik5 StatusConfirmed => Works For Me
        Open/ClosedOpen => Closed
    2016-07-01 rik5 Severity3 - Normal => 4 - Important
    2016-05-15 rik5 CategoryInterpreter => Plotting with OpenGL

    Back to the top


    Powered by Savane 3.5