bugGNU Octave - Bugs: bug #63303, test bsxfun.cc-tst coredumps with...

 
 

bug #63303: test bsxfun.cc-tst coredumps with ASAN

Submitter:  Dmitri A. Sergatskov <dasergatskov>
Submitted:  Wed 02 Nov 2022 12:49:53 AM UTC
   
 
Category:  Interpreter Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Segfault, Bus Error, etc.
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * 7.2.0 Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 03 Nov 2022 08:51:48 AM UTC, comment #11: 

Thanks for testing again (and for checking this in the first place).

I'm also not sure about the results of `test memory`. But let's assume that the address sanitizer somehow influences the return values of the system functions we use. That might lead to those values being interpreted as inconsistent. (I guess "innocent until proven guilty" in this case.)

Closing as fixed.

Markus Mützel <mmuetzel>
Group administrator
Wed 02 Nov 2022 06:32:18 PM UTC, comment #10: 

It goes through make check with "memory" check failing (probably OK, I assume asan messes things up there):


octave:1> test memory
***** testif ; (isunix () && ! ismac ()) || ispc ()
 [user, syst] = memory ();
 assert (user.mem_used_octave > 0);
 assert (user.ram_used_octave <= user.mem_used_octave);
 assert (user.mem_used_octave < syst.SystemMemory.Total);
 assert (user.MemAvailableAllArrays <= syst.SystemMemory.Available);
!!!!! test failed
assert (user.mem_used_octave < syst.SystemMemory.Total) failed
octave:2> [user, syst] = memory ();
octave:3> user.mem_used_octave
ans = 2.1995e+13
octave:4> syst.SystemMemory.Total
ans = 7.7062e+10


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 02 Nov 2022 05:28:48 PM UTC, comment #9: 

That change has been missing from a new feature that was added on the default branch. (I missed that when reviewing that patch.)
Pushed the change from comment #7 here:
https://hg.savannah.gnu.org/hgweb/octave/rev/18a6c1408626


Markus Mützel <mmuetzel>
Group administrator
Wed 02 Nov 2022 05:20:13 PM UTC, comment #8: 

Yes. This fixed lsode problem. Running make check now.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 02 Nov 2022 05:16:11 PM UTC, comment #7: 

IIUC, `m_iwork` is initialized to the `nil_rep`. Indexing it will probably fail.

Does this change fix the issue from comment #4 and #5?

diff -r 2850eef38937 liboctave/numeric/LSODE.cc
--- a/liboctave/numeric/LSODE.cc        Wed Nov 02 17:46:15 2022 +0100
+++ b/liboctave/numeric/LSODE.cc        Wed Nov 02 18:14:07 2022 +0100
@@ -131,6 +131,8 @@

       user_jac_ignore_ml_mu = true;

+      m_iwork = Array<octave_f77_int_type> (dim_vector (2, 1));
+
       m_iwork(0) = lower_jacobian_subdiagonals ();  // 'ML' in dlsode.f

       m_iwork(1) = upper_jacobian_subdiagonals ();  // 'MU' in dlsode.f


Markus Mützel <mmuetzel>
Group administrator
Wed 02 Nov 2022 05:01:33 PM UTC, comment #6: 

I pushed the change from comment #2 to the stable branch here:
https://hg.savannah.gnu.org/hgweb/octave/rev/26da1722407b


Markus Mützel <mmuetzel>
Group administrator
Wed 02 Nov 2022 04:36:03 PM UTC, comment #5: 

This particular case:


octave:1> function xdot = __f (x, t)
> xdot = [-x(2); x(1)];
> endfunction
octave:2> x0 = [1; 0];
octave:3> xdot0 = [0; 1];
octave:4> t = (0:1:10)';
octave:5> tol = 500 * lsode_options ("relative tolerance");
octave:6> x = lsode ("__f", x0, t);
=================================================================
==655900==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003658d0 at pc 0x7fdde403582c bp 0x7fdcc5a69b10 sp 0x7fdcc5a69b08
WRITE of size 4 at 0x6020003658d0 thread T7 (QThread)
    #0 0x7fdde403582b in LSODE::do_integrate(double) ../liboctave/numeric/LSODE.cc:134
    #1 0x7fdde40383c5 in LSODE::do_integrate(ColumnVector const&) ../liboctave/numeric/LSODE.cc:429
    #2 0x7fdde86b89b9 in ODE::integrate(ColumnVector const&) ../liboctave/numeric/ODE.h:92
    #3 0x7fdde86b7191 in octave::Flsode(octave::interpreter&, octave_value_list const&, int) ../libinterp/corefcn/lsode.cc:395
    #4 0x7fdde7cf6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #5 0x7fdde78d53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49

...


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 02 Nov 2022 04:32:52 PM UTC, comment #4: 

I passes this instance, but now crashes at lsode.cc-tst:

octave:1> test lsode.cc-tst
=================================================================
==655204==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003bf4d0 at pc 0x7f90f423582c bp 0x7f8fd5c38960 sp 0x7f8fd5c38958
WRITE of size 4 at 0x6020003bf4d0 thread T7 (QThread)
    #0 0x7f90f423582b in LSODE::do_integrate(double) ../liboctave/numeric/LSODE.cc:134
    #1 0x7f90f42383c5 in LSODE::do_integrate(ColumnVector const&) ../liboctave/numeric/LSODE.cc:429
    #2 0x7f90f88b89b9 in ODE::integrate(ColumnVector const&) ../liboctave/numeric/ODE.h:92
    #3 0x7f90f88b7191 in octave::Flsode(octave::interpreter&, octave_value_list const&, int) ../libinterp/corefcn/lsode.cc:395
    #4 0x7f90f7ef6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #5 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #6 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #7 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #8 0x7f90f7f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #9 0x7f90f7ebfc9e in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:101
    #10 0x7f90f7efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #11 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #12 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #13 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #14 0x7f90f7ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #15 0x7f90f7cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #16 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #17 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #18 0x7f90f7ee1bbc in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:1053
    #19 0x7f90f7ee276b in octave::tree_evaluator::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/parse-tree/pt-eval.cc:1112
    #20 0x7f90f87d6447 in octave::interpreter::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/corefcn/interpreter.cc:1512
    #21 0x7f90f7e7f3ab in octave::Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430
    #22 0x7f90f7ef6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #23 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #24 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #25 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #26 0x7f90f7f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #27 0x7f90f7efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #28 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #29 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #30 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #31 0x7f90f7efc0d8 in octave::tree_evaluator::visit_try_catch_command(octave::tree_try_catch_command&) ../libinterp/parse-tree/pt-eval.cc:4140
    #32 0x7f90f7f395b4 in octave::tree_try_catch_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:84
    #33 0x7f90f7efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #34 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #35 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #36 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #37 0x7f90f7ef9c86 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:3788
    #38 0x7f90f7f11750 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:119
    #39 0x7f90f7ef989d in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:3766
    #40 0x7f90f7f5c980 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:153
    #41 0x7f90f7efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #42 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #43 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #44 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #45 0x7f90f7efd738 in octave::tree_evaluator::visit_unwind_protect_command(octave::tree_unwind_protect_command&) ../libinterp/parse-tree/pt-eval.cc:4285
    #46 0x7f90f7f39628 in octave::tree_unwind_protect_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:151
    #47 0x7f90f7efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #48 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #49 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #50 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #51 0x7f90f7f155bf in void octave::tree_evaluator::execute_range_loop<double>(octave::range<double, void> const&, int, octave::octave_lvalue&, octave::tree_statement_list*) ../libinterp/parse-tree/pt-eval.cc:3049
    #52 0x7f90f7ef337e in octave::tree_evaluator::visit_simple_for_command(octave::tree_simple_for_command&) ../libinterp/parse-tree/pt-eval.cc:3096
    #53 0x7f90f7f5006a in octave::tree_simple_for_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-loop.h:191
    #54 0x7f90f7efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #55 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #56 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #57 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #58 0x7f90f7ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #59 0x7f90f7cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #60 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #61 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #62 0x7f90f7f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #63 0x7f90f7efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #64 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #65 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #66 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #67 0x7f90f7ee1555 in octave::tree_evaluator::eval(std::shared_ptr<octave::tree_statement_list>&, bool) ../libinterp/parse-tree/pt-eval.cc:985
    #68 0x7f90f7ee0243 in octave::tree_evaluator::repl() ../libinterp/parse-tree/pt-eval.cc:804
    #69 0x7f90f87d50e0 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:1350
    #70 0x7f90f87c7b8e in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:916
    #71 0x7f90f9a5bfec in octave::interpreter_qobject::execute() ../libgui/src/interpreter-qobject.cc:89
    #72 0x7f90f9d8d844 in octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-interpreter-qobject.cc:88
    #73 0x7f90f50d1338 in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x2d1338)
    #74 0x7f90f5dae442 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1ae442)
    #75 0x7f90f9ba395a in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/octave-qobject.cc:148
    #76 0x7f90f50a6be7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib64/libQt5Core.so.5+0x2a6be7)
    #77 0x7f90f50aa155 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib64/libQt5Core.so.5+0x2aa155)
    #78 0x7f90f50f84e6 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) (/lib64/libQt5Core.so.5+0x2f84e6)
    #79 0x7f90f07280ae in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x550ae)
    #80 0x7f90f077d307 in g_main_context_iterate.constprop.0 (/lib64/libglib-2.0.so.0+0xaa307)
    #81 0x7f90f07258a2 in g_main_context_iteration (/lib64/libglib-2.0.so.0+0x528a2)
    #82 0x7f90f50f7f87 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2f7f87)
    #83 0x7f90f50a55f1 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2a55f1)
    #84 0x7f90f4ee8349 in QThread::exec() (/lib64/libQt5Core.so.5+0xe8349)
    #85 0x7f90f4ee9545 in QThreadPrivate::start(void*) (/lib64/libQt5Core.so.5+0xe9545)
    #86 0x7f90f129f821 in start_thread (/lib64/libc.so.6+0x9f821)
    #87 0x7f90f123f44f in clone3 (/lib64/libc.so.6+0x3f44f)

0x6020003bf4d1 is located 0 bytes to the right of 1-byte region [0x6020003bf4d0,0x6020003bf4d1)
allocated by thread T7 (QThread) here:
    #0 0x7f90fa6b0087 in operator new(unsigned long) (/lib64/libasan.so.6+0xb0087)
    #1 0x7f90f7cbcdfb in __gnu_cxx::new_allocator<int>::allocate(unsigned long, void const*) /usr/include/c++/11/ext/new_allocator.h:127
    #2 0x7f90f7cbcbd6 in std::allocator_traits<std::allocator<int> >::allocate(std::allocator<int>&, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:464
    #3 0x7f90f7cbc9aa in Array<int, std::allocator<int> >::ArrayRep::allocate(unsigned long) ../liboctave/array/Array.h:197
    #4 0x7f90f80a6589 in Array<int, std::allocator<int> >::ArrayRep::ArrayRep(int*, long) ../liboctave/array/Array.h:147
    #5 0x7f90f80a6412 in Array<int, std::allocator<int> >::make_unique() ../liboctave/array/Array.h:219
    #6 0x7f90f80a6333 in Array<int, std::allocator<int> >::elem(long) ../liboctave/array/Array.h:531
    #7 0x7f90f80a6314 in Array<int, std::allocator<int> >::operator()(long) ../liboctave/array/Array.h:543
    #8 0x7f90f42357f1 in LSODE::do_integrate(double) ../liboctave/numeric/LSODE.cc:134
    #9 0x7f90f42383c5 in LSODE::do_integrate(ColumnVector const&) ../liboctave/numeric/LSODE.cc:429
    #10 0x7f90f88b89b9 in ODE::integrate(ColumnVector const&) ../liboctave/numeric/ODE.h:92
    #11 0x7f90f88b7191 in octave::Flsode(octave::interpreter&, octave_value_list const&, int) ../libinterp/corefcn/lsode.cc:395
    #12 0x7f90f7ef6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #13 0x7f90f7ad53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #14 0x7f90f7bbe0dd in octave_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #15 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #16 0x7f90f7f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #17 0x7f90f7ebfc9e in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:101
    #18 0x7f90f7efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #19 0x7f90f7f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #20 0x7f90f7efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #21 0x7f90f7a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #22 0x7f90f7ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #23 0x7f90f7cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #24 0x7f90f7cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #25 0x7f90f7f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #26 0x7f90f7ee1bbc in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:1053
    #27 0x7f90f7ee276b in octave::tree_evaluator::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/parse-tree/pt-eval.cc:1112
    #28 0x7f90f87d6447 in octave::interpreter::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/corefcn/interpreter.cc:1512
    #29 0x7f90f7e7f3ab in octave::Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430

Thread T7 (QThread) created by T0 here:
    #0 0x7f90fa656866 in pthread_create (/lib64/libasan.so.6+0x56866)
    #1 0x7f90f4ee8fd4 in QThread::start(QThread::Priority) (/lib64/libQt5Core.so.5+0xe8fd4)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../liboctave/numeric/LSODE.cc:134 in LSODE::do_integrate(double)
Shadow bytes around the buggy address:
  0x0c048006fe40: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c048006fe50: fa fa fd fd fa fa fd fa fa fa fd fd fa fa 00 00
  0x0c048006fe60: fa fa 01 fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c048006fe70: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c048006fe80: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa fd fd
=>0x0c048006fe90: fa fa 00 00 fa fa 01 fa fa fa[01]fa fa fa fa fa
  0x0c048006fea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006feb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c048006fee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==655204==ABORTING


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 02 Nov 2022 04:15:09 PM UTC, comment #3: 

I haven't pushed any of my changes to create the release so I could go back and insert this one small change and repackage the release.

John W. Eaton <jwe>
Group administrator
Wed 02 Nov 2022 03:53:58 PM UTC, comment #2: 

Thanks for the report.

It looks like `dim_vector::redim` is used discarding the result.
Does the following change fix it for you?


diff -r 980059c3b129 liboctave/numeric/bsxfun-defs.cc
--- a/liboctave/numeric/bsxfun-defs.cc        Wed Oct 26 20:06:47 2022 +0200
+++ b/liboctave/numeric/bsxfun-defs.cc        Wed Nov 02 16:51:21 2022 +0100
@@ -146,7 +146,7 @@
   dim_vector dvr = r.dims ();
   dim_vector dvx = x.dims ();
   octave_idx_type nd = r.ndims ();
-  dvx.redim (nd);
+  dvx = dvx.redim (nd);

   const X *xvec = x.data ();
   R *rvec = r.fortran_vec ();


It's probably too late for Octave 7.3. But it'd probably be worth to fix on stable anyway.

Markus Mützel <mmuetzel>
Group administrator
Wed 02 Nov 2022 01:07:52 AM UTC, comment #1: 

The actual crash has nothing to do with bsxfun.


octave:1> a = ones (2, 2, 2)
a =

ans(:,:,1) =

   1   1
   1   1

ans(:,:,2) =

   1   1
   1   1

octave:2> b = 2 * ones (2, 1)
b =

   2
   2

octave:3> a .*= b
=================================================================
==558249==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003469e0 at pc 0x7f1d1df8dddf bp 0x7f1bffd39590 sp 0x7f1bffd39588
READ of size 8 at 0x6020003469e0 thread T7 (QThread)
    #0 0x7f1d1df8ddde in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double)) ../liboctave/numeric/bsxfun-defs.cc:185
    #1 0x7f1d1df8bd0d in Array<double, std::allocator<double> >& do_mm_inplace_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double), char const*) ../liboctave/operators/mx-inlines.cc:552
    #2 0x7f1d1df85d1b in MArray<double>& product_eq<double>(MArray<double>&, MArray<double> const&) (/home/dima/src/octave/gcc_asan/liboctave/.libs/liboctave.so.9+0xb85d1b)
    #3 0x7f1d2171daaa in product_eq(NDArray&, NDArray const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0xb1daaa)
    #4 0x7f1d2171cd52 in oct_assignop_assign_el_mul ../libinterp/operators/op-m-m.cc:163
    #5 0x7f1d21ed98c9 in octave_value::assign(octave_value::assign_op, octave_value const&) ../libinterp/octave-value/ov.cc:1701
    #6 0x7f1d220457dd in octave::stack_frame::assign(octave_value::assign_op, octave::symbol_record const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, octave_value const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0x14457dd)
    #7 0x7f1d220438af in octave::octave_lvalue::assign(octave_value::assign_op, octave_value const&) ../libinterp/parse-tree/oct-lvalue.cc:59
    #8 0x7f1d220bfe66 in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:116
    #9 0x7f1d220fa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #10 0x7f1d2215fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #11 0x7f1d220fb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #12 0x7f1d21c14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #13 0x7f1d220e1555 in octave::tree_evaluator::eval(std::shared_ptr<octave::tree_statement_list>&, bool) ../libinterp/parse-tree/pt-eval.cc:985
    #14 0x7f1d220e0243 in octave::tree_evaluator::repl() ../libinterp/parse-tree/pt-eval.cc:804
    #15 0x7f1d229d50e0 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:1350
    #16 0x7f1d229c7b8e in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:916
    #17 0x7f1d23c5bfec in octave::interpreter_qobject::execute() ../libgui/src/interpreter-qobject.cc:89
    #18 0x7f1d23f8d844 in octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-interpreter-qobject.cc:88
    #19 0x7f1d1f2d1338 in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x2d1338)
    #20 0x7f1d1ffae442 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1ae442)
    #21 0x7f1d23da395a in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/octave-qobject.cc:148
    #22 0x7f1d1f2a6be7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib64/libQt5Core.so.5+0x2a6be7)
    #23 0x7f1d1f2aa155 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib64/libQt5Core.so.5+0x2aa155)
    #24 0x7f1d1f2f84e6 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) (/lib64/libQt5Core.so.5+0x2f84e6)
    #25 0x7f1d1a7280ae in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x550ae)
    #26 0x7f1d1a77d307 in g_main_context_iterate.constprop.0 (/lib64/libglib-2.0.so.0+0xaa307)
    #27 0x7f1d1a7258a2 in g_main_context_iteration (/lib64/libglib-2.0.so.0+0x528a2)
    #28 0x7f1d1f2f7f87 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2f7f87)
    #29 0x7f1d1f2a55f1 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2a55f1)
    #30 0x7f1d1f0e8349 in QThread::exec() (/lib64/libQt5Core.so.5+0xe8349)
    #31 0x7f1d1f0e9545 in QThreadPrivate::start(void*) (/lib64/libQt5Core.so.5+0xe9545)
    #32 0x7f1d1b29f821 in start_thread (/lib64/libc.so.6+0x9f821)
    #33 0x7f1d1b23f44f in clone3 (/lib64/libc.so.6+0x3f44f)

0x6020003469e0 is located 0 bytes to the right of 16-byte region [0x6020003469d0,0x6020003469e0)
allocated by thread T7 (QThread) here:
    #0 0x7f1d248b01e7 in operator new[](unsigned long) (/lib64/libasan.so.6+0xb01e7)
    #1 0x7f1d1d7eb557 in dim_vector::dim_vector(dim_vector const&) ../liboctave/array/dim-vector.h:191
    #2 0x7f1d1df8d80e in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double)) ../liboctave/numeric/bsxfun-defs.cc:147
    #3 0x7f1d1df8bd0d in Array<double, std::allocator<double> >& do_mm_inplace_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double), char const*) ../liboctave/operators/mx-inlines.cc:552
    #4 0x7f1d1df85d1b in MArray<double>& product_eq<double>(MArray<double>&, MArray<double> const&) (/home/dima/src/octave/gcc_asan/liboctave/.libs/liboctave.so.9+0xb85d1b)
    #5 0x7f1d2171daaa in product_eq(NDArray&, NDArray const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0xb1daaa)
    #6 0x7f1d2171cd52 in oct_assignop_assign_el_mul ../libinterp/operators/op-m-m.cc:163
    #7 0x7f1d21ed98c9 in octave_value::assign(octave_value::assign_op, octave_value const&) ../libinterp/octave-value/ov.cc:1701
    #8 0x7f1d220457dd in octave::stack_frame::assign(octave_value::assign_op, octave::symbol_record const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, octave_value const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0x14457dd)
    #9 0x7f1d220438af in octave::octave_lvalue::assign(octave_value::assign_op, octave_value const&) ../libinterp/parse-tree/oct-lvalue.cc:59
    #10 0x7f1d220bfe66 in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:116
    #11 0x7f1d220fa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #12 0x7f1d2215fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #13 0x7f1d220fb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #14 0x7f1d21c14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #15 0x7f1d220e1555 in octave::tree_evaluator::eval(std::shared_ptr<octave::tree_statement_list>&, bool) ../libinterp/parse-tree/pt-eval.cc:985
    #16 0x7f1d220e0243 in octave::tree_evaluator::repl() ../libinterp/parse-tree/pt-eval.cc:804
    #17 0x7f1d229d50e0 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:1350
    #18 0x7f1d229c7b8e in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:916
    #19 0x7f1d23c5bfec in octave::interpreter_qobject::execute() ../libgui/src/interpreter-qobject.cc:89
    #20 0x7f1d23f8d844 in octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-interpreter-qobject.cc:88
    #21 0x7f1d1f2d1338 in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x2d1338)
    #22 0x7f1d1ffae442 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1ae442)

Thread T7 (QThread) created by T0 here:
    #0 0x7f1d24856866 in pthread_create (/lib64/libasan.so.6+0x56866)
    #1 0x7f1d1f0e8fd4 in QThread::start(QThread::Priority) (/lib64/libQt5Core.so.5+0xe8fd4)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../liboctave/numeric/bsxfun-defs.cc:185 in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double))
Shadow bytes around the buggy address:
  0x0c0480060ce0: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480060cf0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480060d00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480060d10: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480060d20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x0c0480060d30: fa fa fd fd fa fa fd fd fa fa 00 00[fa]fa 00 00
  0x0c0480060d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480060d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480060d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480060d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480060d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==558249==ABORTING


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Wed 02 Nov 2022 12:49:53 AM UTC, original submission:  

Compiled dev hg id
fa025af77216 tip @
with asan.


octave:1> test libinterp/corefcn/bsxfun.cc-tst
=================================================================
==556598==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003ddc80 at pc 0x7f8a7ed8dddf bp 0x7f8960c28a30 sp 0x7f8960c28a28
READ of size 8 at 0x6020003ddc80 thread T7 (QThread)
    #0 0x7f8a7ed8ddde in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double)) ../liboctave/numeric/bsxfun-defs.cc:185
    #1 0x7f8a7ed8bd0d in Array<double, std::allocator<double> >& do_mm_inplace_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double), char const*) ../liboctave/operators/mx-inlines.cc:552
    #2 0x7f8a7ed85d1b in MArray<double>& product_eq<double>(MArray<double>&, MArray<double> const&) (/home/dima/src/octave/gcc_asan/liboctave/.libs/liboctave.so.9+0xb85d1b)
    #3 0x7f8a8251daaa in product_eq(NDArray&, NDArray const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0xb1daaa)
    #4 0x7f8a8251cd52 in oct_assignop_assign_el_mul ../libinterp/operators/op-m-m.cc:163
    #5 0x7f8a82cd98c9 in octave_value::assign(octave_value::assign_op, octave_value const&) ../libinterp/octave-value/ov.cc:1701
    #6 0x7f8a82e457dd in octave::stack_frame::assign(octave_value::assign_op, octave::symbol_record const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, octave_value const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0x14457dd)
    #7 0x7f8a82e438af in octave::octave_lvalue::assign(octave_value::assign_op, octave_value const&) ../libinterp/parse-tree/oct-lvalue.cc:59
    #8 0x7f8a82ebfe66 in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:116
    #9 0x7f8a82efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #10 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #11 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #12 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #13 0x7f8a82ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #14 0x7f8a82cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #15 0x7f8a82cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #16 0x7f8a82f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #17 0x7f8a82ec1582 in octave::tree_multi_assignment::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:201
    #18 0x7f8a82ee1bbc in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:1053
    #19 0x7f8a82ee276b in octave::tree_evaluator::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/parse-tree/pt-eval.cc:1112
    #20 0x7f8a837d6447 in octave::interpreter::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/corefcn/interpreter.cc:1512
    #21 0x7f8a82e7f3ab in octave::Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430
    #22 0x7f8a82ef6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #23 0x7f8a82ad53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #24 0x7f8a82bbe0dd in octave_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #25 0x7f8a82f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #26 0x7f8a82f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #27 0x7f8a82efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #28 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #29 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #30 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #31 0x7f8a82efc0d8 in octave::tree_evaluator::visit_try_catch_command(octave::tree_try_catch_command&) ../libinterp/parse-tree/pt-eval.cc:4140
    #32 0x7f8a82f395b4 in octave::tree_try_catch_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:84
    #33 0x7f8a82efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #34 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #35 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #36 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #37 0x7f8a82ef9c86 in octave::tree_evaluator::visit_if_command_list(octave::tree_if_command_list&) ../libinterp/parse-tree/pt-eval.cc:3788
    #38 0x7f8a82f11750 in octave::tree_if_command_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:119
    #39 0x7f8a82ef989d in octave::tree_evaluator::visit_if_command(octave::tree_if_command&) ../libinterp/parse-tree/pt-eval.cc:3766
    #40 0x7f8a82f5c980 in octave::tree_if_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-select.h:153
    #41 0x7f8a82efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #42 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #43 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #44 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #45 0x7f8a82efd738 in octave::tree_evaluator::visit_unwind_protect_command(octave::tree_unwind_protect_command&) ../libinterp/parse-tree/pt-eval.cc:4285
    #46 0x7f8a82f39628 in octave::tree_unwind_protect_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-except.h:151
    #47 0x7f8a82efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #48 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #49 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #50 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #51 0x7f8a82f155bf in void octave::tree_evaluator::execute_range_loop<double>(octave::range<double, void> const&, int, octave::octave_lvalue&, octave::tree_statement_list*) ../libinterp/parse-tree/pt-eval.cc:3049
    #52 0x7f8a82ef337e in octave::tree_evaluator::visit_simple_for_command(octave::tree_simple_for_command&) ../libinterp/parse-tree/pt-eval.cc:3096
    #53 0x7f8a82f5006a in octave::tree_simple_for_command::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-loop.h:191
    #54 0x7f8a82efa739 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3915
    #55 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #56 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #57 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #58 0x7f8a82ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #59 0x7f8a82cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #60 0x7f8a82cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #61 0x7f8a82f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #62 0x7f8a82f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #63 0x7f8a82efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #64 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #65 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #66 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #67 0x7f8a82ee1555 in octave::tree_evaluator::eval(std::shared_ptr<octave::tree_statement_list>&, bool) ../libinterp/parse-tree/pt-eval.cc:985
    #68 0x7f8a82ee0243 in octave::tree_evaluator::repl() ../libinterp/parse-tree/pt-eval.cc:804
    #69 0x7f8a837d50e0 in octave::interpreter::main_loop() ../libinterp/corefcn/interpreter.cc:1350
    #70 0x7f8a837c7b8e in octave::interpreter::execute() ../libinterp/corefcn/interpreter.cc:916
    #71 0x7f8a84a5bfec in octave::interpreter_qobject::execute() ../libgui/src/interpreter-qobject.cc:89
    #72 0x7f8a84d8d844 in octave::interpreter_qobject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) libgui/src/moc-interpreter-qobject.cc:88
    #73 0x7f8a800d1338 in QObject::event(QEvent*) (/lib64/libQt5Core.so.5+0x2d1338)
    #74 0x7f8a80dae442 in QApplicationPrivate::notify_helper(QObject*, QEvent*) (/lib64/libQt5Widgets.so.5+0x1ae442)
    #75 0x7f8a84ba395a in octave::octave_qapplication::notify(QObject*, QEvent*) ../libgui/src/octave-qobject.cc:148
    #76 0x7f8a800a6be7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (/lib64/libQt5Core.so.5+0x2a6be7)
    #77 0x7f8a800aa155 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (/lib64/libQt5Core.so.5+0x2aa155)
    #78 0x7f8a800f84e6 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) (/lib64/libQt5Core.so.5+0x2f84e6)
    #79 0x7f8a7b7280ae in g_main_context_dispatch (/lib64/libglib-2.0.so.0+0x550ae)
    #80 0x7f8a7b77d307 in g_main_context_iterate.constprop.0 (/lib64/libglib-2.0.so.0+0xaa307)
    #81 0x7f8a7b7258a2 in g_main_context_iteration (/lib64/libglib-2.0.so.0+0x528a2)
    #82 0x7f8a800f7f87 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2f7f87)
    #83 0x7f8a800a55f1 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (/lib64/libQt5Core.so.5+0x2a55f1)
    #84 0x7f8a7fee8349 in QThread::exec() (/lib64/libQt5Core.so.5+0xe8349)
    #85 0x7f8a7fee9545 in QThreadPrivate::start(void*) (/lib64/libQt5Core.so.5+0xe9545)
    #86 0x7f8a7c29f821 in start_thread (/lib64/libc.so.6+0x9f821)
    #87 0x7f8a7c23f44f in clone3 (/lib64/libc.so.6+0x3f44f)

0x6020003ddc80 is located 0 bytes to the right of 16-byte region [0x6020003ddc70,0x6020003ddc80)
allocated by thread T7 (QThread) here:
    #0 0x7f8a856b01e7 in operator new[](unsigned long) (/lib64/libasan.so.6+0xb01e7)
    #1 0x7f8a7e5eb557 in dim_vector::dim_vector(dim_vector const&) ../liboctave/array/dim-vector.h:191
    #2 0x7f8a7ed8d80e in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double)) ../liboctave/numeric/bsxfun-defs.cc:147
    #3 0x7f8a7ed8bd0d in Array<double, std::allocator<double> >& do_mm_inplace_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double), char const*) ../liboctave/operators/mx-inlines.cc:552
    #4 0x7f8a7ed85d1b in MArray<double>& product_eq<double>(MArray<double>&, MArray<double> const&) (/home/dima/src/octave/gcc_asan/liboctave/.libs/liboctave.so.9+0xb85d1b)
    #5 0x7f8a8251daaa in product_eq(NDArray&, NDArray const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0xb1daaa)
    #6 0x7f8a8251cd52 in oct_assignop_assign_el_mul ../libinterp/operators/op-m-m.cc:163
    #7 0x7f8a82cd98c9 in octave_value::assign(octave_value::assign_op, octave_value const&) ../libinterp/octave-value/ov.cc:1701
    #8 0x7f8a82e457dd in octave::stack_frame::assign(octave_value::assign_op, octave::symbol_record const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<octave_value_list, std::allocator<octave_value_list> > const&, octave_value const&) (/home/dima/src/octave/gcc_asan/libinterp/.libs/liboctinterp.so.10+0x14457dd)
    #9 0x7f8a82e438af in octave::octave_lvalue::assign(octave_value::assign_op, octave_value const&) ../libinterp/parse-tree/oct-lvalue.cc:59
    #10 0x7f8a82ebfe66 in octave::tree_simple_assignment::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:116
    #11 0x7f8a82efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940
    #12 0x7f8a82f5fd66 in octave::tree_statement::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:124
    #13 0x7f8a82efb4e6 in octave::tree_evaluator::visit_statement_list(octave::tree_statement_list&) ../libinterp/parse-tree/pt-eval.cc:4025
    #14 0x7f8a82a14000 in octave::tree_statement_list::accept(octave::tree_walker&) ../libinterp/parse-tree/pt-stmt.h:201
    #15 0x7f8a82ef88bd in octave::tree_evaluator::execute_user_function(octave_user_function&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3664
    #16 0x7f8a82cc2aa2 in octave_user_function::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:494
    #17 0x7f8a82cc2933 in octave_user_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-usr-fcn.cc:487
    #18 0x7f8a82f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #19 0x7f8a82ec1582 in octave::tree_multi_assignment::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-assign.cc:201
    #20 0x7f8a82ee1bbc in octave::tree_evaluator::eval_string(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool, int&, int) ../libinterp/parse-tree/pt-eval.cc:1053
    #21 0x7f8a82ee276b in octave::tree_evaluator::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/parse-tree/pt-eval.cc:1112
    #22 0x7f8a837d6447 in octave::interpreter::eval(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int) ../libinterp/corefcn/interpreter.cc:1512
    #23 0x7f8a82e7f3ab in octave::Feval(octave::interpreter&, octave_value_list const&, int) ../libinterp/parse-tree/oct-parse.yy:6430
    #24 0x7f8a82ef6a50 in octave::tree_evaluator::execute_builtin_function(octave_builtin&, int, octave_value_list const&) ../libinterp/parse-tree/pt-eval.cc:3444
    #25 0x7f8a82ad53cc in octave_builtin::execute(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-builtin.cc:49
    #26 0x7f8a82bbe0dd in octave_function::call(octave::tree_evaluator&, int, octave_value_list const&) ../libinterp/octave-value/ov-fcn.cc:57
    #27 0x7f8a82f42e66 in octave::tree_index_expression::evaluate_n(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.cc:427
    #28 0x7f8a82f48453 in octave::tree_index_expression::evaluate(octave::tree_evaluator&, int) ../libinterp/parse-tree/pt-idx.h:108
    #29 0x7f8a82efa997 in octave::tree_evaluator::visit_statement(octave::tree_statement&) ../libinterp/parse-tree/pt-eval.cc:3940

Thread T7 (QThread) created by T0 here:
    #0 0x7f8a85656866 in pthread_create (/lib64/libasan.so.6+0x56866)
    #1 0x7f8a7fee8fd4 in QThread::start(QThread::Priority) (/lib64/libQt5Core.so.5+0xe8fd4)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../liboctave/numeric/bsxfun-defs.cc:185 in void do_inplace_bsxfun_op<double, double>(Array<double, std::allocator<double> >&, Array<double, std::allocator<double> > const&, void (*)(unsigned long, double*, double const*), void (*)(unsigned long, double*, double))
Shadow bytes around the buggy address:
  0x0c0480073b40: fa fa fa fa fa fa fa fa fa fa fd fd fa fa fa fa
  0x0c0480073b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480073b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480073b70: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fd fd
  0x0c0480073b80: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
=>0x0c0480073b90:[fa]fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480073ba0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480073bb0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480073bc0: fa fa 02 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480073bd0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480073be0: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==556598==ABORTING


Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jwe (Posted a comment)
  • -email is unavailable- added by mmuetzel (Posted a comment)
  • -email is unavailable- added by dasergatskov (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-11-03 mmuetzel StatusNone Fixed
        Open/ClosedOpen Closed
    2022-11-02 mmuetzel Releasedev 7.2.0
        Operating SystemGNU/Linux Any

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code