Number: 477
Title: crash during free()
Submitter: Willem de Bruijn
Date: Mon Jun 21 13:27:03 2004
Subsys: Dot
Version: 1.9
System: x86-Linux-gentoo ebuild; kernel 2.6.5
Severity: minor
Problem:
dot crashed with the following output (using gdb) : 

gdb dot
GNU gdb 6.0
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...(no debugging symbols found)...Using host libthread_db library "/lib/libthread_db.so.1".


(gdb) set args -Tps testgraph.dot -o testgraph.ps
(gdb) run
Starting program: /usr/bin/dot -Tps testgraph.dot -o testgraph.ps
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...
(no debugging symbols found)...(no debugging symbols found)...free(): invalid pointer 0x402ec000!


Program received signal SIGSEGV, Segmentation fault.
0x401c3449 in _IO_file_overflow () from /lib/libc.so.6
(gdb) bt
#0  0x401c3449 in _IO_file_overflow () from /lib/libc.so.6
#1  0x401c492a in __overflow () from /lib/libc.so.6
#2  0x401a2a10 in vfprintf () from /lib/libc.so.6
#3  0x401a7fef in fprintf () from /lib/libc.so.6
#4  0x0808ed41 in toggle ()
#5  0x0807c269 in toggle ()
#6  0x0806b3d9 in ordercmpf ()
#7  0x0804c18d in ?? ()
#8  0x080f9f18 in ?? ()
#9  0x0804c1a0 in ?? ()
#10 0xbffff4b8 in ?? ()
#11 0x4016ec0c in __libc_start_main () from /lib/libc.so.6
Previous frame identical to this frame (corrupt stack?)

Input: 
digraph All {
        17 [label="bytecount"]
        17 -> 5323979
        17 [label="accept"]
        17 -> 5323979
        428816497 [label="accept"]
        428816497 -> 2622095648
        2622095648 [label="bytecount"]
        2622095648 -> 428816497
        5323979 [label="accept"]
        5323979 -> 2622095648
        17 [label="fpl1"]
        17 -> 5323979
        17 [label="fpl1"]
        17 -> 5323979
}
Comments:
perhaps it has to do with the large identifiers given?

[erg] I could not replicate the bug. Given that version 1.9 is involved, it has probably been fixed.
Fix: sorry, I didn't build the debug version of dot
Owner: erg
Status: Inactive