bugGNU Octave - Bugs: bug #47914, segfault with OpenGL patches and...

 
 

bug #47914: segfault with OpenGL patches and address sanitizer

Submitter:  Rik <rik5>
Submitted:  Fri 13 May 2016 05:43:26 PM UTC
   
 
Category:  Plotting with OpenGL Severity:  4 - Important
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Works For Me Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * dev Operating System:  * GNU/Linux
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 04 Sep 2017 04:53:54 AM UTC, comment #20: 

I just did 'rundemos' on scripts/plot/(draw|appearance/utils) and using ASAN options


setenv ASAN_OPTIONS "leak_check_at_exit=0:verbose=1"


and there were no memory leaks or segfaults.  I'm going to close this bug and a new one can be opened new leaks are found.





Rik <rik5>
Group administrator
Sun 03 Sep 2017 03:46:01 PM UTC, comment #19: 

I'm pretty certain now this is a bug in the SW renderer.  I ran the development version recently and the stack trace showed that the problem was with disabling clip planes.


  opengl_renderer::set_clipping (bool enable)
  {
#if defined (HAVE_OPENGL)

    bool has_clipping = (glIsEnabled (GL_CLIP_PLANE0) == GL_TRUE);

    if (enable != has_clipping)
      {
        if (enable)
          for (int i = 0; i < 6; i++)
            glEnable (GL_CLIP_PLANE0+i);
        else
          for (int i = 0; i < 6; i++)
            glDisable (GL_CLIP_PLANE0+i);
      }


I used printf debug statements to find that it was the very first call to


  glDisable (GL_CLIP_PLANE0+i);  // i = 0


which was causing the heap-buffer-overflow.

I get this only when I have set LIBGL_ALWAYS_SOFTWARE to 1.  If I unset this environment variable then the ASAN error goes away.



Rik <rik5>
Group administrator
Mon 29 Aug 2016 10:18:22 PM UTC, comment #18: 

Hi,

I'm a random octave user, and I am finding this in my own C++ applications when compiled with ubsan. I have the same backtrace (different symbol position, but same ubsan error and stack depth).

I found this bug when searching for the crash message - perhaps this is indeed a problem with the video driver...

I'm using debian testing (x86_64), octave 4.0.3-1, as a virtualbox guest (4.3.30 r101610).

I've fired off a rebuild of the octave package with ubsan enabled, but it looks like it might take a while - I'll get back when I have a test package.

$ glxinfo |head -n 60
libGL error: pci id for fd 4: 80ee:beef, driver (null)
OpenGL Warning: Failed to connect to host. Make sure 3D acceleration is enabled for this VM.
libGL error: core dri or dri2 extension not found
libGL error: failed to load driver: vboxvideo
name of display: :0.0
display: :0  screen: 0
direct rendering: Yes
server glx vendor string: SGI
server glx version string: 1.4
server glx extensions:
    GLX_ARB_multisample, GLX_EXT_import_context, GLX_EXT_texture_from_pixmap,
    GLX_EXT_visual_info, GLX_EXT_visual_rating, GLX_MESA_copy_sub_buffer,
    GLX_OML_swap_method, GLX_SGIS_multisample, GLX_SGIX_fbconfig,
    GLX_SGIX_pbuffer, GLX_SGI_make_current_read
client glx vendor string: Mesa Project and SGI
client glx version string: 1.4
client glx extensions:
    GLX_ARB_create_context, GLX_ARB_create_context_profile,
    GLX_ARB_create_context_robustness, GLX_ARB_fbconfig_float,
    GLX_ARB_framebuffer_sRGB, GLX_ARB_get_proc_address, GLX_ARB_multisample,
    GLX_EXT_buffer_age, GLX_EXT_create_context_es2_profile,
    GLX_EXT_create_context_es_profile, GLX_EXT_fbconfig_packed_float,
    GLX_EXT_framebuffer_sRGB, GLX_EXT_import_context,
    GLX_EXT_texture_from_pixmap, GLX_EXT_visual_info, GLX_EXT_visual_rating,
    GLX_INTEL_swap_event, GLX_MESA_copy_sub_buffer,
    GLX_MESA_multithread_makecurrent, GLX_MESA_query_renderer,
    GLX_MESA_swap_control, GLX_OML_swap_method, GLX_OML_sync_control,
    GLX_SGIS_multisample, GLX_SGIX_fbconfig, GLX_SGIX_pbuffer,
    GLX_SGIX_visual_select_group, GLX_SGI_make_current_read,
    GLX_SGI_swap_control, GLX_SGI_video_sync
GLX version: 1.4
GLX extensions:
    GLX_ARB_get_proc_address, GLX_ARB_multisample, GLX_EXT_import_context,
    GLX_EXT_texture_from_pixmap, GLX_EXT_visual_info, GLX_EXT_visual_rating,
    GLX_MESA_copy_sub_buffer, GLX_MESA_multithread_makecurrent,
    GLX_MESA_query_renderer, GLX_OML_swap_method, GLX_SGIS_multisample,
    GLX_SGIX_fbconfig, GLX_SGIX_pbuffer, GLX_SGI_make_current_read
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: VMware, Inc. (0xffffffff)
    Device: llvmpipe (LLVM 3.8, 128 bits) (0xffffffff)
    Version: 11.2.2
    Accelerated: no
    Video memory: 2971MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 3.3
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: VMware, Inc.
OpenGL renderer string: Gallium 0.4 on llvmpipe (LLVM 3.8, 128 bits)
OpenGL version string: 3.0 Mesa 11.2.2
OpenGL shading language version string: 1.30
OpenGL context flags: (none)
OpenGL extensions:
    GL_AMD_conservative_depth, GL_AMD_draw_buffers_blend,
    GL_AMD_seamless_cubemap_per_texture, GL_AMD_shader_stencil_export,
    GL_AMD_shader_trinary_minmax, GL_ANGLE_texture_compression_dxt3,
    GL_ANGLE_texture_compression_dxt5, GL_APPLE_packed_pixels,
    GL_APPLE_vertex_array_object, GL_ARB_ES2_compatibility,
    GL_ARB_ES3_compatibility, GL_ARB_arrays_of_arrays, GL_ARB_base_instance,
    GL_ARB_blend_func_extended, GL_ARB_buffer_storage,
    GL_ARB_clear_buffer_object, GL_ARB_clip_control,
    GL_ARB_color_buffer_float, GL_ARB_compressed_texture_pixel_storage,

Person <mycae>
Fri 29 Jul 2016 10:09:14 PM UTC, comment #17: 

Still failing with the patch.  Here is the traceback I see from the address sanitizer:


octave:1> demo patch 2
patch example 2:
 %% Unclosed patch
 clf;
 t1 = (1/16:1/8:1)' * 2*pi;
 t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
 x1 = sin (t1) - 0.8;
 y1 = cos (t1);
 x2 = sin (t2) + 0.8;
 y2 = cos (t2);
 patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

octave:2> =================================================================
==32698==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002c77c0 at pc 0x7f1ab9d27445 bp 0x7ffd298c6000 sp 0x7ffd298c57b0
READ of size 68 at 0x6180002c77c0 thread T0
    #0 0x7f1ab9d27444 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x88444)
    #1 0x7f1a8199b0b3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3370b3)
    #2 0x7f1a819a222f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33e22f)
    #3 0x7f1a819a15b9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33d5b9)
    #4 0x7f1a8199ef3d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33af3d)
    #5 0x7f1a8199ffe3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x33bfe3)
    #6 0x7f1a81a7ae34  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x416e34)
    #7 0x7f1a81a7b0ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x4170ce)
    #8 0x7f1a819af548  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x34b548)
    #9 0x7f1a819a8114  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x344114)
    #10 0x7f1a819a8638  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x344638)
    #11 0x7f1a81cc3b0e  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x65fb0e)
    #12 0x7f1a8186194e  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1fd94e)
    #13 0x7f1a81833643  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1cf643)
    #14 0x7f1a8181f2eb  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1bb2eb)
    #15 0x7f1a81830422  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1cc422)
    #16 0x7f1a8173bf18  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xd7f18)
    #17 0x7f1ab8985b18 in opengl_renderer::draw_axes_children(axes::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:1735
    #18 0x7f1ab898663e in opengl_renderer::draw_axes(axes::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:1817
    #19 0x7f1ab897c633 in opengl_renderer::draw(graphics_object const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:660
    #20 0x7f1ab98c9479 in opengl_renderer::draw(Matrix const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.h:52
    #21 0x7f1ab897daed in opengl_renderer::draw_figure(figure::properties const&) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:730
    #22 0x7f1ab897c535 in opengl_renderer::draw(graphics_object const&, bool) /home/jwe/src/octave/libinterp/corefcn/gl-render.cc:658
    #23 0x7f1ab98a3f3f in QtHandles::GLCanvas::draw(octave_handle const&) /home/jwe/src/octave/libgui/graphics/GLCanvas.cc:63
    #24 0x7f1ab98878dd in QtHandles::Canvas::canvasPaintEvent() /home/jwe/src/octave/libgui/graphics/Canvas.cc:319
    #25 0x7f1ab98a453d in QtHandles::GLCanvas::paintGL() /home/jwe/src/octave/libgui/graphics/GLCanvas.cc:144
    #26 0x7f1ab47672a4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2a4)
    #27 0x7f1ab4766d5c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd5c)
    #28 0x7f1ab3c6512f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x21b12f)
    #29 0x7f1ab4770760 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x36760)
    #30 0x7f1ab3c0e90b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c490b)
    #31 0x7f1ab3c15845 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cb845)
    #32 0x7f1ab36e28fc in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a8fc)
    #33 0x7f1ab3c5f796 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x215796)
    #34 0x7f1ab3e2f0bc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e50bc)
    #35 0x7f1ab3c52456 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x208456)
    #36 0x7f1ab3c65217 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x21b217)
    #37 0x7f1ab4770760 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x36760)
    #38 0x7f1ab3c0e90b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c490b)
    #39 0x7f1ab3c15845 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cb845)
    #40 0x7f1ab36e28fc in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a8fc)
    #41 0x7f1ab36e63b5 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e3b5)
    #42 0x7f1ab37130a2  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb0a2)
    #43 0x7f1aac872fd6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49fd6)
    #44 0x7f1aac87322f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a22f)
    #45 0x7f1aac8732db in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2db)
    #46 0x7f1ab37131f3 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1f3)
    #47 0x7f1ab3cb89d5  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26e9d5)
    #48 0x7f1ab36e117e in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18917e)
    #49 0x7f1ab36e14e4 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1894e4)
    #50 0x7f1ab36e74a8 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f4a8)
    #51 0x7f1ab97bc4e9 in octave::gui_application::execute() /home/jwe/src/octave/libgui/src/octave-gui.cc:227
    #52 0x401ebb in main /home/jwe/src/octave/src/main-gui.cc:104
    #53 0x7f1ab4fb572f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2072f)
    #54 0x4018f8 in _start (/scratch/jwe/build/octave-asan/src/.libs/lt-octave-gui+0x4018f8)

0x6180002c77c0 is located 0 bytes to the right of 832-byte region [0x6180002c7480,0x6180002c77c0)
allocated by thread T0 here:
    #0 0x7f1ab9d32f4a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x93f4a)
    #1 0x7f1a81a7aab7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x416ab7)


John W. Eaton <jwe>
Group administrator
Thu 28 Jul 2016 04:45:55 PM UTC, comment #16: 

That error might be caused by the current implementation of lights. On one of my systems, the constant GL_MAX_LIGHTS is way too high. I am not sure what happens in the following lines when "i" increases way too far:

  // disable other OpenGL lights
  for (int i = num_lights; i < GL_MAX_LIGHTS; i++)
    glDisable (GL_LIGHT0 + i);


A fix for this is contained in file #37999 in patch #8943.

It might also be completely unrelated but comment #14 rang a bell to me.

Markus Mützel <mmuetzel>
Group administrator
Thu 28 Jul 2016 12:53:32 PM UTC, comment #15: 

BTW, I also see that this error happens if I set graphics_toolkit to fltk, so it seems more like a bug in OpenGL an error in the way we are calling OpenGL routines rather than memory corruption caused by threading in the Qt graphics code.

John W. Eaton <jwe>
Group administrator
Thu 28 Jul 2016 06:27:40 AM UTC, comment #14: 

Oh, I see.  That also causes a crash for me.  The traceback I get says that it is happening in the function call


glDisable (GL_DEPTH_TEST);


in opengl_renderer::draw_axes_children.

John W. Eaton <jwe>
Group administrator
Thu 28 Jul 2016 06:14:04 AM UTC, comment #13: 

I can reproduce this problem if i set LIBGL_ALWAYS_SOFTWARE=1:

ASAN_OPTIONS=alloc_dealloc_mismatch=0 LIBGL_ALWAYS_SOFTWARE=1 ./run-octave --no-gui

octave:1> demo patch 2
patch example 2:
 %% Unclosed patch
 clf;
 t1 = (1/16:1/8:1)' * 2*pi;
 t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
 x1 = sin (t1) - 0.8;
 y1 = cos (t1);
 x2 = sin (t2) + 0.8;
 y2 = cos (t2);
 patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

octave:2> =================================================================
==22330==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160004418c0 at pc 0x7fd08ca29ccf bp 0x7ffe8b3cd320 sp 0x7ffe8b3ccac8
READ of size 52 at 0x6160004418c0 thread T0
    #0 0x7fd08ca29cce  (/lib64/libasan.so.3+0x5ecce)
    #1 0x7fd0576d9d23  (/usr/lib64/dri/swrast_dri.so+0x36bd23)
....
SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.3+0x5ecce)
Shadow bytes around the buggy address:
  0x0c2c800802c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800802d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c800802e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c800802f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c80080300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c80080310: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c2c80080320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80080330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80080360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22330==ABORTING


Dmitri A. Sergatskov <dasergatskov>
Thu 28 Jul 2016 04:10:41 AM UTC, comment #12: 

I can't duplicate this problem either.  I compiled with the address sanitizer options and default compiler flags and also "-O0 -ggdb3" and I did not see a crash.  Memory leaks were reported when I exited Octave, but that's it.

Also, I still can't start the GUI when compiling with the sanitizer flags.

Maybe this is just buggy OpenGL drivers or libraries?  I don't know what we can do about that.  I have the following:


$ glxinfo -B
name of display: :0
display: :0  screen: 0
direct rendering: Yes
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: X.Org (0x1002)
    Device: AMD RS880 (DRM 2.43.0, LLVM 3.7.1) (0x9715)
    Version: 11.1.1
    Accelerated: yes
    Video memory: 512MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 3.3
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: X.Org
OpenGL renderer string: Gallium 0.4 on AMD RS880 (DRM 2.43.0, LLVM 3.7.1)
OpenGL core profile version string: 3.3 (Core Profile) Mesa 11.1.1
OpenGL core profile shading language version string: 3.30
OpenGL core profile context flags: (none)
OpenGL core profile profile mask: core profile

OpenGL version string: 3.0 Mesa 11.1.1
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

OpenGL ES profile version string: OpenGL ES 3.0 Mesa 11.1.1
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.00


John W. Eaton <jwe>
Group administrator
Tue 12 Jul 2016 08:08:18 PM UTC, comment #11: 


changeset:   22099:4c0f78b3c86f

I cannot complete the doc build if I compile with -fsanitize=address ; there are too many leaks building voronoi.txt.
It gives up with
SUMMARY: AddressSanitizer: 126332 byte(s) leaked in 2675 allocation(s).
Makefile:27702: recipe for target 'doc/interpreter/voronoi.txt' failed

(I had to set  ASAN_OPTIONS=new_delete_type_mismatch=0 or I get
SUMMARY: AddressSanitizer: new-delete-type-mismatch (/lib64/libasan.so.3+0xc8b60) in operator delete(void*, unsigned long)
)

I could run
ASAN_OPTIONS=new_delete_type_mismatch=0 ./run-octave --no-gui
and execute 'demo patch 2" w/ no problem after that)

This is on ccomputer with nvidia card:

glxinfo -B
name of display: :0
display: :0  screen: 0
direct rendering: Yes
Extended renderer info (GLX_MESA_query_renderer):
    Vendor: nouveau (0x10de)
    Device: NVC3 (0xdd8)
    Version: 11.2.2
    Accelerated: yes
    Video memory: 995MB
    Unified memory: no
    Preferred profile: core (0x1)
    Max core profile version: 4.1
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.0
OpenGL vendor string: nouveau
OpenGL renderer string: Gallium 0.4 on NVC3
OpenGL core profile version string: 4.1 (Core Profile) Mesa 11.2.2 (git-5de088f)
OpenGL core profile shading language version string: 4.10
OpenGL core profile context flags: (none)
OpenGL core profile profile mask: core profile

OpenGL version string: 3.0 Mesa 11.2.2 (git-5de088f)
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

OpenGL ES profile version string: OpenGL ES 3.0 Mesa 11.2.2 (git-5de088f)
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.00

Please tell me if I am doing something wrong. I will try on different  hardware later today.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Tue 12 Jul 2016 05:39:05 PM UTC, comment #10: 

Very possible.

Anyways, I tested with regular -O2 options and it still crashes.

Rik <rik5>
Group administrator
Tue 12 Jul 2016 05:24:57 PM UTC, comment #9: 

It might also be the mesa driver for your particular system, or the version of mesa, since I see swrast_dri.so at the top of the stack where the buffer overflow is reported.

Mike Miller <mtmiller>
Group Member
Tue 12 Jul 2016 05:19:03 PM UTC, comment #8: 

It might be my version of gcc (Ubuntu 5.2.1-22ubuntu2) among other things.

Rik <rik5>
Group administrator
Tue 12 Jul 2016 05:09:57 PM UTC, comment #7: 

This still fails for me with cset 5ad67277b007.  This is a debug version so I am setting '-O0 -g' in the flags.  I'll try again with a regular build to see if optimizations stop the segfault.



demo patch 2
patch example 2:
 %% Unclosed patch
 clf;
 t1 = (1/16:1/8:1)' * 2*pi;
 t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
 x1 = sin (t1) - 0.8;
 y1 = cos (t1);
 x2 = sin (t2) + 0.8;
 y2 = cos (t2);
 patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');

=================================================================
==16388==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002dafc0 at pc 0x7f2a6837ed95 bp 0x7ffe847f0ac0 sp 0x7ffe847f0268
READ of size 68 at 0x6180002dafc0 thread T0
    #0 0x7f2a6837ed94 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cd94)
    #1 0x7f2a3ad8fbf3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x30ebf3)
    #2 0x7f2a3ad96d6f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x315d6f)
    #3 0x7f2a3ad960f9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3150f9)
    #4 0x7f2a3ad93a7d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x312a7d)
    #5 0x7f2a3ad94b23  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x313b23)
    #6 0x7f2a3ae69034  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e8034)
    #7 0x7f2a3ae692b5  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e82b5)
    #8 0x7f2a3ada4018  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x323018)
    #9 0x7f2a3ad9cc44  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31bc44)
    #10 0x7f2a3ad9d168  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31c168)
    #11 0x7f2a3b0842ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x6032ce)
    #12 0x7f2a3ac59bde  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1d8bde)
    #13 0x7f2a3ac2d989  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1ac989)
    #14 0x7f2a3ac1421b  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x19321b)
    #15 0x7f2a3ac2a7d2  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1a97d2)
    #16 0x7f2a3ab38769  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xb7769)
    #17 0x7f2a66f7faa6 in opengl_renderer::draw_axes_children(axes::properties const&) libinterp/corefcn/gl-render.cc:1695
    #18 0x7f2a66f80724 in opengl_renderer::draw_axes(axes::properties const&) libinterp/corefcn/gl-render.cc:1777
    #19 0x7f2a66f7607b in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:630
    #20 0x7f2a67f5e50a in opengl_renderer::draw(Matrix const&, bool) libinterp/corefcn/gl-render.h:52
    #21 0x7f2a66f777c1 in opengl_renderer::draw_figure(figure::properties const&) libinterp/corefcn/gl-render.cc:700
    #22 0x7f2a66f75f7a in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:628
    #23 0x7f2a67f350ce in QtHandles::GLCanvas::draw(octave_handle const&) libgui/graphics/GLCanvas.cc:63
    #24 0x7f2a67f160a8 in QtHandles::Canvas::canvasPaintEvent() libgui/graphics/Canvas.cc:319
    #25 0x7f2a67f35701 in QtHandles::GLCanvas::paintGL() libgui/graphics/GLCanvas.cc:144
    #26 0x7f2a6300f2e4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2e4)
    #27 0x7f2a6300ed9c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd9c)
    #28 0x7f2a62509e1f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218e1f)
    #29 0x7f2a630187a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #30 0x7f2a624b5cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #31 0x7f2a624bcc15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #32 0x7f2a61f8985c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #33 0x7f2a62504476 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x213476)
    #34 0x7f2a626d6bfc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e5bfc)
    #35 0x7f2a624f7116 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x206116)
    #36 0x7f2a62509f07 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218f07)
    #37 0x7f2a630187a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #38 0x7f2a624b5cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #39 0x7f2a624bcc15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #40 0x7f2a61f8985c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #41 0x7f2a61f8d315 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e315)
    #42 0x7f2a61fba07d  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb07d)
    #43 0x7f2a5ad91ff6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49ff6)
    #44 0x7f2a5ad9224f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a24f)
    #45 0x7f2a5ad922fb in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2fb)
    #46 0x7f2a61fba1ed in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1ed)
    #47 0x7f2a62560c25  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26fc25)
    #48 0x7f2a61f880d0 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1890d0)
    #49 0x7f2a61f88444 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x189444)
    #50 0x7f2a61f8e428 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f428)
    #51 0x7f2a67e40de9 in octave::gui_application::execute() libgui/src/octave-gui.cc:224
    #52 0x401fb8 in main src/main-gui.cc:104
    #53 0x7f2a63d82abf in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20abf)
    #54 0x401998 in _start (/home/rik/wip/Projects_Mine/octave-dbg/src/.libs/lt-octave-gui+0x401998)

0x6180002dafc0 is located 0 bytes to the right of 832-byte region [0x6180002dac80,0x6180002dafc0)
allocated by thread T0 here:
    #0 0x7f2a6838a9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f2a3ae68cb7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e7cb7)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c30800535a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c30800535e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c30800535f0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c3080053600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3080053610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3080053640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==16388==ABORTING


Rik <rik5>
Group administrator
Tue 12 Jul 2016 05:02:59 PM UTC, comment #6: 

I build with the following configure options for gcc's address sanitizer:


../configure -C --build=x86_64-linux --with-blas=blas \
  --disable-java --enable-address-sanitizer-flags \
  "CFLAGS=-O0 -ggdb3" \
  "CXXFLAGS=-O0 -ggdb3" \
  "FFLAGS=-O0 -ggdb3"


I get many leaks detected, but no heap-buffer-overflow.

Mike Miller <mtmiller>
Group Member
Tue 12 Jul 2016 01:10:59 PM UTC, comment #5: 

I checked that "-fsanitize=address" was properly added in the config.log but still, after rebuilding, I couldn't trigger the heap-buffer-overflow by simply running "demo patch 2". Anything more I should do?

Pantxo Diribarne <pantxo>
Group Member
Tue 12 Jul 2016 12:18:30 PM UTC, comment #4: 

Sorry, spoke too soon ... I copied the configure option from comment #1 and ran "make" without checking the config log. Actually it should be "--enable-address-sanitizer-flags". Rebuilding now.

Pantxo Diribarne <pantxo>
Group Member
Tue 12 Jul 2016 11:49:28 AM UTC, comment #3: 

@Rik: I tried to reproduce this but I am not sure about the way to go. I configured octave with "../octave/configure --enable-address-sanitizer" and then rebuilt the default branch. Simply running the demo after "./run-octave -f --no-gui" is not enough to trigger a bug. Is there any flag we must pass to run-octave in order to enable the address checking? Should I run octave from gdb?

Pantxo Diribarne <pantxo>
Group Member
Fri 13 May 2016 06:22:15 PM UTC, comment #2: 

I'm guessing that they are related.  Why don't you file a separate bug report about that, and then we can link it as a dependency of this report.

Rik <rik5>
Group administrator
Fri 13 May 2016 06:14:19 PM UTC, comment #1: 

Talking about sanitizing and patch:
patch() doesn't check input sufficiently rigorously.
In case of "patch ('vertices', f, 'faces', ...)" calls, when f contains NaN rows, Octave segfaults (very) hard.  Should I file a separate bug report for that?

Philip Nienhuis <philipnienhuis>
Group Member
Fri 13 May 2016 05:43:26 PM UTC, original submission:  

When Octave has been configured with the --enable-address-sanitizer option, the second patch demo causes a segmentation violation.  The log is shown below.


>> clf;
>>  t1 = (1/16:1/8:1)' * 2*pi;
>>  t2 = ((1/16:1/16:1)' + 1/32) * 2*pi;
>>  x1 = sin (t1) - 0.8;
>>  y1 = cos (t1);
>>  x2 = sin (t2) + 0.8;
>>  y2 = cos (t2);
>> patch ([[x1;NaN(8,1)],x2], [[y1;NaN(8,1)],y2], 'r');
>>
=================================================================
==13896==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180002ae7c0 at pc 0x7f1f009ded95 bp 0x7ffef2b046b0 sp 0x7ffef2b03e58
READ of size 68 at 0x6180002ae7c0 thread T0
    #0 0x7f1f009ded94 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cd94)
    #1 0x7f1ed1fabbf3  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x30ebf3)
    #2 0x7f1ed1fb2d6f  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x315d6f)
    #3 0x7f1ed1fb20f9  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3150f9)
    #4 0x7f1ed1fafa7d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x312a7d)
    #5 0x7f1ed1fb0b23  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x313b23)
    #6 0x7f1ed2085034  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e8034)
    #7 0x7f1ed20852b5  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e82b5)
    #8 0x7f1ed1fc0018  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x323018)
    #9 0x7f1ed1fb8c44  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31bc44)
    #10 0x7f1ed1fb9168  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x31c168)
    #11 0x7f1ed22a02ce  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x6032ce)
    #12 0x7f1ed1e75bde  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1d8bde)
    #13 0x7f1ed1e49989  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1ac989)
    #14 0x7f1ed1e3021b  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x19321b)
    #15 0x7f1ed1e467d2  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x1a97d2)
    #16 0x7f1ed1d54769  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xb7769)
    #17 0x7f1efeeca0d7 in opengl_renderer::draw_axes_children(axes::properties const&) libinterp/corefcn/gl-render.cc:1571
    #18 0x7f1efeecab2d in opengl_renderer::draw_axes(axes::properties const&) libinterp/corefcn/gl-render.cc:1645
    #19 0x7f1efeec10b9 in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:620
    #20 0x7f1f004c7018 in opengl_renderer::draw(Matrix const&, bool) libinterp/corefcn/gl-render.h:52
    #21 0x7f1efeec2587 in opengl_renderer::draw_figure(figure::properties const&) libinterp/corefcn/gl-render.cc:675
    #22 0x7f1efeec0fb8 in opengl_renderer::draw(graphics_object const&, bool) libinterp/corefcn/gl-render.cc:618
    #23 0x7f1f0049e78c in QtHandles::GLCanvas::draw(octave_handle const&) libgui/graphics/GLCanvas.cc:67
    #24 0x7f1f0047f002 in QtHandles::Canvas::canvasPaintEvent() libgui/graphics/Canvas.cc:319
    #25 0x7f1f0049edab in QtHandles::GLCanvas::paintGL() libgui/graphics/GLCanvas.cc:148
    #26 0x7f1ef9da32e4 in QGLWidget::glDraw() (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2d2e4)
    #27 0x7f1ef9da2d9c in QGLWidget::paintEvent(QPaintEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x2cd9c)
    #28 0x7f1ef929de1f in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218e1f)
    #29 0x7f1ef9dac7a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #30 0x7f1ef9249cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #31 0x7f1ef9250c15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #32 0x7f1ef8d1d85c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #33 0x7f1ef9298476 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&, QPoint const&, int, QPainter*, QWidgetBackingStore*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x213476)
    #34 0x7f1ef946abfc in QWidgetPrivate::repaint_sys(QRegion const&) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x3e5bfc)
    #35 0x7f1ef928b116 in QWidgetPrivate::syncBackingStore() (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x206116)
    #36 0x7f1ef929df07 in QWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x218f07)
    #37 0x7f1ef9dac7a0 in QGLWidget::event(QEvent*) (/usr/lib/x86_64-linux-gnu/libQtOpenGL.so.4+0x367a0)
    #38 0x7f1ef9249cdb in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1c4cdb)
    #39 0x7f1ef9250c15 in QApplication::notify(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x1cbc15)
    #40 0x7f1ef8d1d85c in QCoreApplication::notifyInternal(QObject*, QEvent*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18a85c)
    #41 0x7f1ef8d21315 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18e315)
    #42 0x7f1ef8d4e07d  (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb07d)
    #43 0x7f1ef1fdbff6 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49ff6)
    #44 0x7f1ef1fdc24f  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a24f)
    #45 0x7f1ef1fdc2fb in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a2fb)
    #46 0x7f1ef8d4e1ed in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1bb1ed)
    #47 0x7f1ef92f4c25  (/usr/lib/x86_64-linux-gnu/libQtGui.so.4+0x26fc25)
    #48 0x7f1ef8d1c0d0 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x1890d0)
    #49 0x7f1ef8d1c444 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x189444)
    #50 0x7f1ef8d22428 in QCoreApplication::exec() (/usr/lib/x86_64-linux-gnu/libQtCore.so.4+0x18f428)
    #51 0x7f1f003b3a4c in octave_start_gui(int, char**, bool) libgui/src/octave-gui.cc:198
    #52 0x403b0d in main src/main-gui.cc:106
    #53 0x7f1efa5f0a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #54 0x4035f8 in _start (/home/rik/wip/Projects_Mine/octave-dbg/src/.libs/lt-octave-gui+0x4035f8)

0x6180002ae7c0 is located 0 bytes to the right of 832-byte region [0x6180002ae480,0x6180002ae7c0)
allocated by thread T0 here:
    #0 0x7f1f009ea9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7f1ed2084cb7  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x3e7cb7)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c308004dca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dcd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c308004dce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c308004dcf0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c308004dd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c308004dd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c308004dd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==13896==ABORTING



Rik <rik5>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mycae (Posted a comment)
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by jwe (Posted a comment)
  • -email is unavailable- added by dasergatskov (Posted a comment)
  • -email is unavailable- added by mtmiller (Posted a comment)
  • -email is unavailable- added by pantxo (Posted a comment)
  • -email is unavailable- added by rik5 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-09-04 rik5 StatusConfirmed Works For Me
        Open/ClosedOpen Closed
    2016-07-01 rik5 Severity3 - Normal 4 - Important
    2016-05-15 rik5 CategoryInterpreter Plotting with OpenGL

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code