|Anonymous | Login||2017-11-19 09:07 EST|
|Main | My View | View Issues | Change Log | Roadmap | My Account|
|View Issue Details|
|ID||Project||Category||View Status||Date Submitted||Last Update|
|0001845||graphviz||Circo||public||2010-03-24 19:53||2011-04-28 04:03|
|Platform||OS||*-*-Debian Linux||OS Version|
|Summary||0001845: Segfault when running Circo|
I've had the following bug reported against the graphviz Debian package
(debian bug #575255) ...
The backtrace says it all ... I've tried on two unstable machine with
the same result. It seems a recent problem. I've attached the dot file,
but I don't think it is related to a specific file.
*** glibc detected *** circo: free(): invalid next size (fast): 0x00000000007032c0 ***
======= Backtrace: =========
Ordinarily I would have redone that backtrace with debug symbols ...
This time however it looks like I don't need to since Francis
Russell (who submitted the dot -y bug) was kind enough to jump in and
take a look ...
"I did a little investigation into this which may or may not be helpful. The
problem appears to be with the call to position in lib/circogen/circpos.c.
position iterates over a linked list and conditionally saves values into an
array called parents. parents has the size 'childCount', however, in the single
place position is called the linked list has the size 'length'. If
length>childCount and enough iterations add a value to the parents array,
its bounds may be overrun. Changing the line 'posinfo_t* parents =
N_NEW(childCount, posinfo_t);' to 'posinfo_t* parents = N_NEW(length,
posinfo_t);' fixes the segfault, though it's not clear if this method's being
called with an incorrect assumption about the values of childCount and length
I've confirmed his suggested fix does appear fix the problem (reproduced
below as a patch for convenience). However as Francis says, there may be
more to this if the linked list is not expected to ever contain more
than 'childCount' nodes.
Please can you take a look and see what you think?
The problem actually occurred up-stream, which was breaking the pre-conditions for the
position() function. In general, each child only has one parent, so there should never be
more parents than children.
|Tags||No tags attached.|
diff --git a/lib/circogen/circpos.c b/lib/circogen/circpos.c
index 7b66602..e5da26d 100644
@@ -366,7 +366,7 @@ position(Agraph_t * g, int childCount, int length, nodelist_t * path,
|STATUS-COMMENT||Fixed (30 Mar 2010)|
|2011-04-28 04:03||user1||New Issue|
|2011-04-28 04:03||user1||Assigned To||=> erg|
|MantisBT 1.2.5[^] Copyright © 2000 - 2011 MantisBT Group|