bugGNU Octave - Bugs: bug #51736, Memory overflow in icholt

 
 

bug #51736: Memory overflow in icholt

Submitter:  None
Submitted:  Sat 12 Aug 2017 01:14:21 PM UTC
   
 
Category:  Octave Function Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Richard Zweig Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * dev
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 12 Aug 2017 09:06:16 PM UTC, comment #4: 

Try this link: http://hg.savannah.gnu.org/hgweb/octave/rev/b590c674e27d.  I accidentally pasted the same link twice before.

Rik <rik5>
Group administrator
Sat 12 Aug 2017 08:33:32 PM UTC, comment #3: 

Thanks for your quick response.
The link to the BIST directs me to file _ichol_.cc and its patcht, though.

Anonymous
Sat 12 Aug 2017 06:52:18 PM UTC, comment #2: 

I added a longer commit message which follows Octave coding conventions, and also used the fill constructors for std::vector objects to initialize them.  I checked the change in first on the stable branch, in case a 4.2.2 bug fix release is made, but also pulled it across to the development branch.  See http://hg.savannah.gnu.org/hgweb/octave/rev/437ba51e8bcf.

I also added your example as a BIST test here http://hg.savannah.gnu.org/hgweb/octave/rev/437ba51e8bcf.

Marking as fixed and closing report.

Rik <rik5>
Group administrator
Sat 12 Aug 2017 05:56:23 PM UTC, comment #1: 

Confirmed.  I ran your test program with a development version of Octave compiled with out-of-bounds memory detection and it segfaults when constructing ichol_t with a heap-buffer-overflow.

I will review the patch.

Rik <rik5>
Group administrator
Sat 12 Aug 2017 01:14:21 PM UTC, original submission:  

Hi,

my report refers to the Octave 4.2.1 and the lastest development version from the public repository. I think there is a memory error from overflowing array

std::vector<octave_idx_type> vec;

in function icholt from source file _ichol_.cc.

I appended a script which terminates my Octave 4.2.1 session when I run it in Linux. Please look a the comments in that .m file for what I have observed when executing the script in Octave 4.2.1.

The second attachment is a patch which can be applied to _ichol_.cc. Script ichol_example.m can be run succesfully when these changes are made.

Maybe you would like to consider fixing this,
Richard


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #41490:  ichol_example.m added by None (2KiB - text/x-objcsrc - Minimum (non-)working example which reproduces the error and a possible solution introducing a mark array in function icholt from file _ichol_.cc.)
file #41491:  ichol_mark_array.patch added by None (2KiB - text/x-patch - Minimum (non-)working example which reproduces the error and a possible solution introducing a mark array in function icholt from file _ichol_.cc.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-08-12 rik5 StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2017-08-12 rik5 StatusNone Confirmed
    2017-08-12 None Attached File- Added ichol_example.m, #41490
        Attached File- Added ichol_mark_array.patch, #41491

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code