After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 770078 - Invalid free (memory corruption) in OptionGroup caused by wrong command line arguments
Invalid free (memory corruption) in OptionGroup caused by wrong command line ...
Status: RESOLVED FIXED
Product: glibmm
Classification: Bindings
Component: general
2.49.x
Other Linux
: Normal normal
: ---
Assigned To: gtkmm-forge
gtkmm-forge
Depends on: 646926
Blocks:
 
 
Reported: 2016-08-18 09:01 UTC by Andrejs Hanins
Modified: 2016-09-13 07:10 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
failed program (524 bytes, text/x-c++src)
2016-08-18 09:01 UTC, Andrejs Hanins
Details

Description Andrejs Hanins 2016-08-18 09:01:15 UTC
Created attachment 333549 [details]
failed program

Compile attached program and run under valgrind using arguments "-t x -txxx x".

valgrind ./a.out -t x -txxx x
 Memcheck, a memory error detector
 Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
 Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
 Command: ./a.out -t x -t1 x
 
 Invalid free() / delete / delete[] / realloc()
    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x4E7ED18: Glib::OptionGroup::CppOptionEntry::release_c_arg() (optiongroup.cc:684)
    by 0x4E7ED50: Glib::OptionGroup::release_gobject() (optiongroup.cc:332)
    by 0x4E7EEA6: Glib::OptionGroup::~OptionGroup() (optiongroup.cc:344)
    by 0x40137C: MyOptionGroup::~MyOptionGroup() (in /home/andrey/tmp/test/a.out)
    by 0x401132: main (in /home/andrey/tmp/test/a.out)
  Address 0x6e80710 is 0 bytes inside a block of size 5 free'd
    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x60417EF: parse_arg.isra.11 (goption.c:1284)
    by 0x6042043: parse_short_option (goption.c:1558)
    by 0x6043528: g_option_context_parse (goption.c:2066)
    by 0x4E7DD9A: Glib::OptionContext::parse(int&, char**&) (optioncontext.cc:212)
    by 0x401126: main (in /home/andrey/tmp/test/a.out)

Reproducible with git-master of glib and glibmm as of 18-August-2016.
The bug was initially found under OpenWrt with musl libc where it causes segfault.
Comment 1 Kjell Ahlstedt 2016-08-31 14:13:48 UTC
This is a bug in glib. It was reported more than 5 years ago!
See bug 646926.
Comment 2 Kjell Ahlstedt 2016-09-13 07:10:07 UTC
Bug 646926 has been fixed, fixing this bug too.