bugGNU Octave - Bugs: bug #55397, test imwrite error with address...

 
 

bug #55397: test imwrite error with address sanitizer

Submitter:  Dmitri A. Sergatskov <dasergatskov>
Submitted:  Sat 05 Jan 2019 06:25:43 PM UTC
   
 
Category:  Test Suite Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Works For Me Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * 5.0.1 Operating System:  * GNU/Linux
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 19 Jan 2019 12:22:40 AM UTC, comment #14: 

Thanks.  I'm pretty sure this is an upstream bug at this point.  ASAN identifies the leak in Magick library when the exception about a bad format is attempted to be thrown


    #1 0x7f74a3edd7b0 in GetLocaleExceptionMessage (/lib64/libGraphicsMagick-Q16.so.3+0xa97b0)


Rik <rik5>
Group administrator
Fri 18 Jan 2019 11:32:33 PM UTC, comment #13: 

Do not see any change:


octave:1> imwrite (1, "filename", "junk")
warning: imwrite: unlisted image format junk (see imformats).  Trying to save anyway.
warning: called from
    imwrite at line 115 column 5
=================================================================
==29911==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000399f8 at pc 0x7f74a87db2dd bp 0x7ffc45c8bbe0 sp 0x7ffc45c8b388
READ of size 5 at 0x6250000399f8 thread T0
    #0 0x7f74a87db2dc  (/lib64/libasan.so.5+0xa22dc)
    #1 0x7f74a3edd7b0 in GetLocaleExceptionMessage (/lib64/libGraphicsMagick-Q16.so.3+0xa97b0)
    #2 0x7f74a3eddc9e in ThrowLoggedException (/lib64/libGraphicsMagick-Q16.so.3+0xa9c9e)
    #3 0x7f74a3ec2103 in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e103)
    #4 0x7f74a3ec235a in WriteImages (/lib64/libGraphicsMagick-Q16.so.3+0x8e35a)
    #5 0x7f74a7551829 in void Magick::writeImages<__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > > >(__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, __gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.6+0x1829829)
    #6 0x7f74a752830a in write_file ../libinterp/corefcn/__magick_read__.cc:1446
    #7 0x7f74a752ae89 in F__magick_write__(octave_value_list const&, int) ../libinterp/corefcn/__magick_read__.cc:1632
    #8 0x7f74a6ff4984 in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:65
    #9 0x7f74a7463ee2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2008
    #10 0x7f74a749f428 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
<<<...>>>


Here is what I did to

../libinterp/corefcn/__magick_read__.cc


void static
write_file (const std::string& filename,
            const std::string& ext,
            std::vector<Magick::Image>& imvec)
{
  //try
    {
      Magick::writeImages (imvec.begin (), imvec.end (), ext + ':' + filename);
    }
  /*catch (Magick::Warning& w)
    {
      warning ("Magick++ warning: %s", w.what ());
    }
  catch (Magick::ErrorCoder& e)
    {
      warning ("Magick++ coder error: %s", e.what ());
    }
  catch (Magick::Exception& e)
    {
      error ("Magick++ exception: %s", e.what ());
    }
    */
}



Dmitri A. Sergatskov <dasergatskov>
Fri 18 Jan 2019 10:42:12 PM UTC, comment #12: 

I think the problem may be the exception handling.  The code in _magick_read_.cc is


void static
write_file (const std::string& filename,
            const std::string& ext,
            std::vector<Magick::Image>& imvec)
{
  try
    {
      Magick::writeImages (imvec.begin (), imvec.end (), ext + ':' + filename);
    }
  catch (Magick::Warning& w)
    {
      warning ("Magick++ warning: %s", w.what ());
    }
  catch (Magick::ErrorCoder& e)
    {
      warning ("Magick++ coder error: %s", e.what ());
    }
  catch (Magick::Exception& e)
    {
      error ("Magick++ exception: %s", e.what ());
    }
}


@Dmitri: Could you try commenting out all of the catch blocks, re-compiling, and then testing with


imwrite (1, "filename", "junk")



Rik <rik5>
Group administrator
Tue 08 Jan 2019 06:06:04 AM UTC, comment #11: 

Still the same. Do not see any change.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Tue 08 Jan 2019 12:38:42 AM UTC, comment #10: 

I doubt it will fix the issue, but I just checked in a fix for a static analyzer detected issue with _magick_read_.cc which might be relevant (https://hg.savannah.gnu.org/hgweb/octave/rev/72e0a106d956).

Rik <rik5>
Group administrator
Mon 07 Jan 2019 02:17:52 AM UTC, comment #9: 

I tried to compile with ASAN convert.c example program
http://www.graphicsmagick.org/api/api.html

and I do not see any problem with it.
So perhaps it is still octave problem...

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 07 Jan 2019 01:48:45 AM UTC, comment #8: 

Might be due to:

http://www.graphicsmagick.org/Changelog.html

2018-11-22 Bob Friesenhahn <bfriesen@simple.dallas.tx.us>

magick/constitute.c (WriteImage): Eliminate use of just-freed memory in clone_info->magick when throwing exception due to no support for format. Fixes SourceForge issue #576 "heap use-after-freee when convert one format into another format".

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 07 Jan 2019 01:41:32 AM UTC, comment #7: 

So 1.3.30 is also OK but 1.3.31 crashes.

Dmitri.

Dmitri A. Sergatskov <dasergatskov>
Mon 07 Jan 2019 01:36:14 AM UTC, comment #6: 

I downgraded to 1.3.28 and the problem gone away.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 07 Jan 2019 01:28:36 AM UTC, comment #5: 

I also have GraphicsMagick, and I checked the config log and I am using it over ImageMagick.


libgraphicsmagick++1-dev                        1.3.28-2



Rik <rik5>
Group administrator
Sun 06 Jan 2019 09:40:29 PM UTC, comment #4: 

So you are using ImageMagick I thought we preferred GraphicsMagick
(I am using GraphicsMagick-1.3.31-2.fc29.x86_64).

But it does appear to be a bug in GraphicsMagick; it cannot handle
wrong input...

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sun 06 Jan 2019 09:05:02 PM UTC, comment #3: 

This works for me.  I get


octave:1>  imwrite (1, "filename", "junk")
warning: imwrite: unlisted image format junk (see imformats).  Trying to save anyway.
warning: called from
    imwrite at line 115 column 5
error: Magick++ exception: Magick: No encode delegate for this image format (filename) reported by magick/constitute.c:2283 (WriteImage)
error: called from
    __imwrite__ at line 215 column 3
    imwrite at line 117 column 5


This is with


libmagick++-6.q16-7:amd64                       8:6.9.7.4+dfsg-16ubuntu6.4



Rik <rik5>
Group administrator
Sun 06 Jan 2019 07:26:05 PM UTC, comment #2: 

The test that causing ASAN to crash is
imwrite (1, "filename", "junk"):



octave:1> imwrite (1, "filename", "junk")
warning: imwrite: unlisted image format junk (see imformats).  Trying to save anyway.
warning: called from
    imwrite at line 115 column 5
=================================================================
==3451==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250000411f8 at pc 0x7fd9726ca2dd bp 0x7ffc47c73d80 sp 0x7ffc47c73528
READ of size 5 at 0x6250000411f8 thread T0
    #0 0x7fd9726ca2dc  (/lib64/libasan.so.5+0xa22dc)
    #1 0x7fd96ddcf7b0 in GetLocaleExceptionMessage (/lib64/libGraphicsMagick-Q16.so.3+0xa97b0)
    #2 0x7fd96ddcfc9e in ThrowLoggedException (/lib64/libGraphicsMagick-Q16.so.3+0xa9c9e)
    #3 0x7fd96ddb4103 in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e103)
    #4 0x7fd96ddb435a in WriteImages (/lib64/libGraphicsMagick-Q16.so.3+0x8e35a)
    #5 0x7fd971442301 in void Magick::writeImages<__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > > >(__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, __gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/home/dima/src/octave/gcc_asan_min/libinterp/.libs/liboctinterp.so.6+0x1828301)
    #6 0x7fd971418bb7 in write_file ../libinterp/corefcn/__magick_read__.cc:1446
    #7 0x7fd97141b960 in F__magick_write__(octave_value_list const&, int) ../libinterp/corefcn/__magick_read__.cc:1631
    #8 0x7fd970ee4a30 in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:6
<<<etc... >>>>


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 05 Jan 2019 06:41:11 PM UTC, comment #1: 

Here is the same test with a minimal octave (no qt, no java):


test image/imwrite.m
[Detaching after fork from child process 27877]
[Detaching after fork from child process 27878]
warning: Loadable section ".note.gnu.property" outside of ELF segments
warning: Loadable section ".note.gnu.property" outside of ELF segments
[Detaching after fork from child process 27879]
=================================================================
==27830==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500003e9f8 at pc 0x7ffff72792dd bp 0x7ffffffed1a0 sp 0x7ffffffec948
READ of size 5 at 0x62500003e9f8 thread T0
    #0 0x7ffff72792dc  (/lib64/libasan.so.5+0xa22dc)
    #1 0x7ffff297e7b0 in GetLocaleExceptionMessage (/lib64/libGraphicsMagick-Q16.so.3+0xa97b0)
    #2 0x7ffff297ec9e in ThrowLoggedException (/lib64/libGraphicsMagick-Q16.so.3+0xa9c9e)
    #3 0x7ffff2963103 in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e103)
    #4 0x7ffff296335a in WriteImages (/lib64/libGraphicsMagick-Q16.so.3+0x8e35a)
    #5 0x7ffff5ff1301 in void Magick::writeImages<__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > > >(__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, __gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/home/dima/src/octave/gcc_asan_min/libinterp/.libs/liboctinterp.so.6+0x1828301)
    #6 0x7ffff5fc7bb7 in write_file ../libinterp/corefcn/__magick_read__.cc:1446
    #7 0x7ffff5fca960 in F__magick_write__(octave_value_list const&, int) ../libinterp/corefcn/__magick_read__.cc:1631
    #8 0x7ffff5a93a30 in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:65
    #9 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #10 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #11 0x7ffff5b67641 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #12 0x7ffff5f0bb1b in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #13 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #14 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #15 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #16 0x7ffff5f008e0 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #17 0x7ffff5ce782e in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #18 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #19 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #20 0x7ffff5b67641 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #21 0x7ffff5f0bb1b in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #22 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #23 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #24 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #25 0x7ffff5f02997 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #26 0x7ffff5ee55ce in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #27 0x7ffff5f025a9 in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #28 0x7ffff5f532ae in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #29 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #30 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #31 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #32 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #33 0x7ffff5f008e0 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #34 0x7ffff5ce782e in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #35 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #36 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #37 0x7ffff5b67641 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #38 0x7ffff5f0bb1b in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #39 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #40 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #41 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #42 0x7ffff5f008e0 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #43 0x7ffff5ce782e in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #44 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #45 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #46 0x7ffff5f1be0d in octave::tree_evaluator::evaluate_n(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:343
    #47 0x7ffff5ef27d6 in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:242
    #48 0x7ffff5ef2ffe in octave::tree_evaluator::eval_string(octave_value const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:286
    #49 0x7ffff66edc37 in octave::interpreter::eval_string(octave_value const&, bool, int&, int) ../libinterp/corefcn/interpreter.cc:1150
    #50 0x7ffff5e9c5fc in Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:5485
    #51 0x7ffff5a93c1b in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:71
    #52 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #53 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #54 0x7ffff5b67641 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #55 0x7ffff5f0bb1b in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #56 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #57 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #58 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #59 0x7ffff5f0cf27 in octave::tree_evaluator::visit_try_catch_command(octave::tree_try_catch_command&) ../libinterp/parse-tree/pt-eval.cc:2961
    #60 0x7ffff5f36a00 in octave::tree_try_catch_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:81
    #61 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #62 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #63 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #64 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #65 0x7ffff5f02997 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #66 0x7ffff5ee55ce in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #67 0x7ffff5f025a9 in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #68 0x7ffff5f532ae in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #69 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #70 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #71 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #72 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #73 0x7ffff5f02997 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #74 0x7ffff5ee55ce in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #75 0x7ffff5f025a9 in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #76 0x7ffff5f532ae in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #77 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #78 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #79 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #80 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #81 0x7ffff5f0e2c2 in octave::tree_evaluator::visit_unwind_protect_command(octave::tree_unwind_protect_command&) ../libinterp/parse-tree/pt-eval.cc:3100
    #82 0x7ffff5f36a74 in octave::tree_unwind_protect_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:148
    #83 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #84 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #85 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #86 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #87 0x7ffff5efce6d in octave::tree_evaluator::visit_simple_for_command(octave::tree_simple_for_command&) ../libinterp/parse-tree/pt-eval.cc:1295
    #88 0x7ffff5f46b9e in octave::tree_simple_for_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-loop.h:219
    #89 0x7ffff5f0b946 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #90 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #91 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #92 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #93 0x7ffff5f008e0 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #94 0x7ffff5ce782e in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #95 0x7ffff5f0379e in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #96 0x7ffff5f3ece4 in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #97 0x7ffff5b67641 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #98 0x7ffff5f0bb1b in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #99 0x7ffff5f56566 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #100 0x7ffff5f0c1fc in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #101 0x7ffff5b6826c in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #102 0x7ffff5ef19ef in octave::tree_evaluator::repl(bool) ../libinterp/parse-tree/pt-eval.cc:105
    #103 0x7ffff66ea724 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:949
    #104 0x7ffff66e77c7 in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:694
    #105 0x7ffff50245fe in octave::cli_application::execute() ../libinterp/octave.cc:391
    #106 0x402954 in main ../src/main-cli.cc:92
    #107 0x7fffeefe8412 in __libc_start_main (/lib64/libc.so.6+0x24412)
    #108 0x4022ad in _start (/home/dima/src/octave/gcc_asan_min/src/.libs/lt-octave-cli+0x4022ad)

0x62500003e9f8 is located 248 bytes inside of 8536-byte region [0x62500003e900,0x625000040a58)
freed by thread T0 here:
    #0 0x7ffff72c6480 in free (/lib64/libasan.so.5+0xef480)
    #1 0x7ffff29630cf in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e0cf)

previously allocated by thread T0 here:
    #0 0x7ffff72c6848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848)
    #1 0x7ffff2990096 in CloneImageInfo (/lib64/libGraphicsMagick-Q16.so.3+0xbb096)

SUMMARY: AddressSanitizer: heap-use-after-free (/lib64/libasan.so.5+0xa22dc)
Shadow bytes around the buggy address:
  0x0c4a7ffffce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7ffffcf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7ffffd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7ffffd10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7ffffd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a7ffffd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c4a7ffffd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7ffffd50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7ffffd60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7ffffd70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a7ffffd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==27830==ABORTING


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 05 Jan 2019 06:25:43 PM UTC, original submission:  

After compiling aced09cc1721 (stable) tip (5.0.1) with address sanitizer flags. Running under gdb:


ASAN_OPTIONS=verbosity=0:leak_check_at_exit=0 ./run-octave -g -q -f



==21637==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250001bd1f8 at pc 0x7ffff72792dd bp 0x7fffd2c256f0 sp 0x7fffd2c24e98
READ of size 5 at 0x6250001bd1f8 thread T7 (QThread)
    #0 0x7ffff72792dc  (/lib64/libasan.so.5+0xa22dc)
    #1 0x7ffff0b327b0 in GetLocaleExceptionMessage (/lib64/libGraphicsMagick-Q16.so.3+0xa97b0)
    #2 0x7ffff0b32c9e in ThrowLoggedException (/lib64/libGraphicsMagick-Q16.so.3+0xa9c9e)
    #3 0x7ffff0b17103 in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e103)
    #4 0x7ffff0b1735a in WriteImages (/lib64/libGraphicsMagick-Q16.so.3+0x8e35a)
    #5 0x7ffff58edfd9 in void Magick::writeImages<__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > > >(__gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, __gnu_cxx::__normal_iterator<Magick::Image*, std::vector<Magick::Image, std::allocator<Magick::Image> > >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.6+0x1858fd9)
    #6 0x7ffff58c488f in write_file ../libinterp/corefcn/__magick_read__.cc:1446
    #7 0x7ffff58c7638 in F__magick_write__(octave_value_list const&, int) ../libinterp/corefcn/__magick_read__.cc:1631
    #8 0x7ffff536a870 in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:65
    #9 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #10 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #11 0x7ffff543e481 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #12 0x7ffff5808e1f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #13 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #14 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #15 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #16 0x7ffff57fdbe4 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #17 0x7ffff55e5e9a in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #18 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #19 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #20 0x7ffff543e481 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #21 0x7ffff5808e1f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #22 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #23 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #24 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #25 0x7ffff57ffc9b in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #26 0x7ffff57e28d2 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #27 0x7ffff57ff8ad in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #28 0x7ffff5850196 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #29 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #30 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #31 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #32 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #33 0x7ffff57fdbe4 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #34 0x7ffff55e5e9a in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #35 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #36 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #37 0x7ffff543e481 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #38 0x7ffff5808e1f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #39 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #40 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #41 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #42 0x7ffff57fdbe4 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #43 0x7ffff55e5e9a in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #44 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #45 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #46 0x7ffff5819081 in octave::tree_evaluator::evaluate_n(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:343
    #47 0x7ffff57efada in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:242
    #48 0x7ffff57f0302 in octave::tree_evaluator::eval_string(octave_value const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:286
    #49 0x7ffff5fea019 in octave::interpreter::eval_string(octave_value const&, bool, int&, int) ../libinterp/corefcn/interpreter.cc:1150
    #50 0x7ffff5799fac in Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:5485
    #51 0x7ffff536aa5b in octave_builtin::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:71
    #52 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #53 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #54 0x7ffff543e481 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #55 0x7ffff5808e1f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #56 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #57 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #58 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #59 0x7ffff580a22b in octave::tree_evaluator::visit_try_catch_command(octave::tree_try_catch_command&) ../libinterp/parse-tree/pt-eval.cc:2961
    #60 0x7ffff58338e8 in octave::tree_try_catch_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:81
    #61 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #62 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #63 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #64 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #65 0x7ffff57ffc9b in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #66 0x7ffff57e28d2 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #67 0x7ffff57ff8ad in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #68 0x7ffff5850196 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #69 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #70 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #71 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #72 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #73 0x7ffff57ffc9b in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:1862
    #74 0x7ffff57e28d2 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:115
    #75 0x7ffff57ff8ad in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:1840
    #76 0x7ffff5850196 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:148
    #77 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #78 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #79 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #80 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #81 0x7ffff580b5c6 in octave::tree_evaluator::visit_unwind_protect_command(octave::tree_unwind_protect_command&) ../libinterp/parse-tree/pt-eval.cc:3100
    #82 0x7ffff583395c in octave::tree_unwind_protect_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:148
    #83 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #84 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #85 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #86 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #87 0x7ffff57fa171 in octave::tree_evaluator::visit_simple_for_command(octave::tree_simple_for_command&) ../libinterp/parse-tree/pt-eval.cc:1295
    #88 0x7ffff5843a86 in octave::tree_simple_for_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-loop.h:219
    #89 0x7ffff5808c4a in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2753
    #90 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #91 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #92 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #93 0x7ffff57fdbe4 in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:1694
    #94 0x7ffff55e5e9a in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:455
    #95 0x7ffff5800aa2 in octave::tree_evaluator::visit_index_expression(octave::tree_index_expression&) ../libinterp/parse-tree/pt-eval.cc:2007
    #96 0x7ffff583bbcc in octave::tree_index_expression::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-idx.h:102
    #97 0x7ffff543e481 in octave::tree_evaluator::evaluate(octave::tree_expression*, int) ../libinterp/parse-tree/pt-eval.h:312
    #98 0x7ffff5808e1f in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:2775
    #99 0x7ffff585344e in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:119
    #100 0x7ffff5809500 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:2844
    #101 0x7ffff543f0ac in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:194
    #102 0x7ffff57eecf3 in octave::tree_evaluator::repl(bool) ../libinterp/parse-tree/pt-eval.cc:105
    #103 0x7ffff5fe6b06 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:949
    #104 0x7ffff5fe3ba9 in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:694
    #105 0x7ffff6daebb1 in octave::octave_interpreter::execute() ../libgui/src/main-window.cc:146
    #106 0x7ffff6f81405 in octave::octave_interpreter::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-main-window.cc:89
    #107 0x7ffff2f920f5 in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x27b0f5)
    #108 0x7ffff38e42a4 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x16d2a4)
    #109 0x7ffff38eb9bf in QApplication::notify(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1749bf)
    #110 0x7ffff6dda780 in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/main-window.cc:2783
    #111 0x7ffff2f69235 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib64/libQt5Core.so.5+0x252235)
    #112 0x7ffff2f6c40a in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib64/libQt5Core.so.5+0x25540a)
    #113 0x7ffff2fb9a86  (/lib64/libQt5Core.so.5+0x2a2a86)
    #114 0x7fffeacd606c in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x4f06c)
    #115 0x7fffeacd6437  (/lib64/libglib-2.0.so.0+0x4f437)
    #116 0x7fffeacd64cf in g_main_context_iteration (/lib64/libglib-2.0.so.0+0x4f4cf)
    #117 0x7ffff2fb9812 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2a2812)
    #118 0x7ffff2f6817a in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x25117a)
    #119 0x7ffff2dd0045 in QThread::exec() (/lib64/libQt5Core.so.5+0xb9045)
    #120 0x7ffff2dd94ba  (/lib64/libQt5Core.so.5+0xc24ba)
    #121 0x7fffed34158d in start_thread (/lib64/libpthread.so.0+0x858d)
    #122 0x7fffed2706a2 in clone (/lib64/libc.so.6+0xfd6a2)

0x6250001bd1f8 is located 248 bytes inside of 8536-byte region [0x6250001bd100,0x6250001bf258)
freed by thread T7 (QThread) here:
    #0 0x7ffff72c6480 in free (/lib64/libasan.so.5+0xef480)
    #1 0x7ffff0b170cf in WriteImage (/lib64/libGraphicsMagick-Q16.so.3+0x8e0cf)

previously allocated by thread T7 (QThread) here:
    #0 0x7ffff72c6848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848)
    #1 0x7ffff0b44096 in CloneImageInfo (/lib64/libGraphicsMagick-Q16.so.3+0xbb096)

Thread T7 (QThread) created by T0 here:
    #0 0x7ffff7223043 in __interceptor_pthread_create (/lib64/libasan.so.5+0x4c043)
    #1 0x7ffff2dd8f36 in QThread::start(QThread::Priority) (/lib64/libQt5Core.so.5+0xc1f36)

SUMMARY: AddressSanitizer: heap-use-after-free (/lib64/libasan.so.5+0xa22dc)
Shadow bytes around the buggy address:
  0x0c4a8002f9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002f9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fa20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a8002fa30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c4a8002fa40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a8002fa50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a8002fa60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a8002fa70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4a8002fa80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==21637==ABORTING
[Thread 0x7fffd2082700 (LWP 21662) exited]
[Thread 0x7fffd2c35700 (LWP 21661) exited]
[Thread 0x7fffd4165700 (LWP 21658) exited]
[Thread 0x7fffd5193700 (LWP 21656) exited]
[Thread 0x7fffd599c700 (LWP 21655) exited]
[Thread 0x7fffd6fd5700 (LWP 21654) exited]
[Thread 0x7fffe7756a40 (LWP 21637) exited]
[Inferior 1 (process 21637) exited with code 01]


Perhaps it is false positive. Will retest w/o Qt.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by dasergatskov (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-01-19 rik5 Open/ClosedOpen Closed
    2019-01-06 rik5 StatusNone Works For Me

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code