bugGNU Octave - Bugs: bug #51736, Memory overflow in icholt

 
 

bug #51736: Memory overflow in icholt

Submitted by:  None
Submitted on:  Sat 12 Aug 2017 01:14:21 PM UTC  
 
Category: Octave FunctionSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Segfault, Bus Error, etc.
Status: FixedAssigned to: None
Originator Name: Richard ZweigOriginator Email: -unavailable-
Open/Closed: ClosedRelease: dev
Operating System: Any

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 12 Aug 2017 09:06:16 PM UTC, comment #4:

Try this link: http://hg.savannah.gnu.org/hgweb/octave/rev/b590c674e27d. I accidentally pasted the same link twice before.

Rik <rik5>
Project Administrator
Sat 12 Aug 2017 08:33:32 PM UTC, comment #3:

Thanks for your quick response.
The link to the BIST directs me to file _ichol_.cc and its patcht, though.

Anonymous
Sat 12 Aug 2017 06:52:18 PM UTC, comment #2:

I added a longer commit message which follows Octave coding conventions, and also used the fill constructors for std::vector objects to initialize them. I checked the change in first on the stable branch, in case a 4.2.2 bug fix release is made, but also pulled it across to the development branch. See http://hg.savannah.gnu.org/hgweb/octave/rev/437ba51e8bcf.

I also added your example as a BIST test here http://hg.savannah.gnu.org/hgweb/octave/rev/437ba51e8bcf.

Marking as fixed and closing report.

Rik <rik5>
Project Administrator
Sat 12 Aug 2017 05:56:23 PM UTC, comment #1:

Confirmed. I ran your test program with a development version of Octave compiled with out-of-bounds memory detection and it segfaults when constructing ichol_t with a heap-buffer-overflow.

I will review the patch.

Rik <rik5>
Project Administrator
Sat 12 Aug 2017 01:14:21 PM UTC, original submission:

Hi,

my report refers to the Octave 4.2.1 and the lastest development version from the public repository. I think there is a memory error from overflowing array

std::vector<octave_idx_type> vec;

in function icholt from source file _ichol_.cc.

I appended a script which terminates my Octave 4.2.1 session when I run it in Linux. Please look a the comments in that .m file for what I have observed when executing the script in Octave 4.2.1.

The second attachment is a patch which can be applied to _ichol_.cc. Script ichol_example.m can be run succesfully when these changes are made.

Maybe you would like to consider fixing this,
Richard

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41490:  ichol_example.m added by None (2KiB - text/x-objcsrc - Minimum (non-)working example which reproduces the error and a possible solution introducing a mark array in function icholt from file _ichol_.cc.)
file #41491:  ichol_mark_array.patch added by None (2KiB - text/x-patch - Minimum (non-)working example which reproduces the error and a possible solution introducing a mark array in function icholt from file _ichol_.cc.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rik5 (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 12 Aug 2017 06:52:18 PM UTCrik5StatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed
    Sat 12 Aug 2017 05:56:23 PM UTCrik5StatusNone=>Confirmed
    Sat 12 Aug 2017 01:14:21 PM UTCNoneAttached File-=>Added ichol_example.m, #41490
      Attached File-=>Added ichol_mark_array.patch, #41491

    Back to the top


    Powered by Savane 3.1-cleanup1