#15010: attempting free on address which was not malloc

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010>

#15010: attempting free on address which was not malloc
-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new
Priority: high | Milestone:
Component: GUI-all | Version:
Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------
I compiled the current svn-head (2.9x) of wxWidgets with clang compiler
(version 3.2), which has a new feature, called address sanitizer. The
address-sanitizer is a fast memory error detector, which is integrated
into the clang-compiler and is able to detect heap,stack,global-buffer
overflow bugs in C/C++ code.

After compiling the library on my system ( Ubuntu 12.10, 64 Bit) and
exectued the minimal sample, the following output by the address sanitizer
was generated:

{{{
=================================================================
==28716== ERROR: AddressSanitizer: attempting free on address which was
not malloc()-ed: 0x000003789040
#0 0x4299b0 in operator delete(void*) ??:?
#1 0x419fc0 in wxScopedCharTypeBuffer<wchar_t>::DecRef()
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/samples/minimal/../../../include/wx/buffer.h:198
#2 0x419f18 in ~wxScopedCharTypeBuffer /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-
clang/samples/minimal/../../../include/wx/buffer.h:128
#3 0x419d68 in ~wxScopedCharTypeBuffer /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-
clang/samples/minimal/../../../include/wx/buffer.h:127
#4 0x7f8a5dab12c6 in wxCharTypeBuffer<wchar_t>
wxString::tchar_str<wchar_t>(unsigned long*, wchar_t*) const
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../include/wx/string.h:1708
#5 0x7f8a5dab1032 in wxStringTypeBufferBase /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-clang/../include/wx/string.h:3841
#6 0x7f8a5db1bb08 in wxStringInternalBuffer /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-clang/../include/wx/string.h:3927
#7 0x7f8a5db1a888 in wxStringInternalBuffer /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-clang/../include/wx/string.h:3927
#8 0x7f8a5db15c19 in wxString::FromAscii(char const*, unsigned long)
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/string.cpp:1180
#9 0x7f8a5db15dc2 in wxString::FromAscii(char const*)
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/string.cpp:1198
#10 0x7f8a5dad4b88 in wxLocale::GetSystemEncodingName()
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/intl.cpp:800
#11 0x7f8a5dad4cf1 in wxLocale::GetSystemEncoding()
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/intl.cpp:874
#12 0x7f8a5db07014 in wxCSConv::SetEncoding(wxFontEncoding)
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/strconv.cpp:2988
#13 0x7f8a5db082ba in wxCSConv /home/martin/wxWidgets/wxWidgets-svn-
trunk/build-clang/../src/common/strconv.cpp:3035
#14 0x7f8a5db08ec0 in wxGet_wxConvLocalPtr() /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-clang/../src/common/strconv.cpp:3451
#15 0x7f8a5da25aa8 in __cxx_global_var_init42 /home/martin/wxWidgets
/wxWidgets-svn-trunk/build-clang/../src/common/strconv.cpp:3451
#16 0x7f8a5da25b6b in global constructors keyed to a
/home/martin/wxWidgets/wxWidgets-svn-trunk/build-
clang/../src/common/strconv.cpp:292
#17 0x7f8a5eed6315 in call_init /build/buildd/eglibc-2.15/elf/dl-
init.c:85
Stats: 0M malloced (0M for red zones) by 0 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 0 calls
Stats: 0M really freed by 0 calls
Stats: 0M (0 full pages) mmaped in 0 calls
mmaps by size class:
mallocs by size class:
frees by size class:
rfrees by size class:
Stats: malloc large: 0 small slow: 0
==28716== ABORTING
}}}

Steps to reproduce:

Download the wxWidgets sources from github with following command
$ git clone https://github.com/wxWidgets/wxWidgets.git

Download the newest version of the clang compiler at
http://llvm.org/releases/
Configure in order to use the clang compiler and the address-sanitizer (
Note: you have to adapt the path, where the clang compiler is located on
your system):
$ cd wxWidgets
$ mkdir build-clang
$ cd build-clang
$ ../configure CXX=/home/martin/clang+llvm-3.2-x86_64-linux-
ubuntu-12.04/bin/clang++ CC='/home/martin/clang+llvm-3.2-x86_64-linux-
ubuntu-12.04/bin/clang' CFLAGS='-fsanitize=address -O1 -fno-omit-frame-
pointer -fno-optimize-sibling-calls -g' CXXFLAGS='-fsanitize=address -O1
-fno-omit-frame-pointer -fno-optimize-sibling-calls -g' LDFLAGS='-g
-fsanitize=address'
Then compile the library with
$ make
$ cd samples/minimal
$ make
$ ./minimal

Can anybody assist me here? Maybe this is only happen on Ubuntu, 64 Bit?

Btw, i have also tried serval other samples and all have the same result
as the reported sample.

If you need further information, please let me know.

Anyway many thanks in advance

Martin Ettl


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:1>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new

Priority: low | Milestone:
Component: base | Version:

Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------

Changes (by vadz):

* priority: high => low
* component: GUI-all => base


Comment:

`m_data` pointer is either allocated on the heap (using `new` operator) or
set to static `GetNullData()`. So the first thing would be to check under
debugger if its value is equal to the latter. If it is, then it's not
supposed to be deleted at all. If it isn't, then the pointer must be heap-
allocated.

In any case, I've just reran the minimal sample under valgrind and it
doesn't find any problems so I'm relatively confident that it's an address
sanitizer problem and not a real bug in the code. I'd be interested in
fixing it as I'd like to make it possible to use AS with wx programs in
the future but it's not that important.


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:1>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:2>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new

Priority: low | Milestone:
Component: base | Version:

Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------

Comment(by ksserebr):

Looks like asan bug, investigating.
https://code.google.com/p/address-sanitizer/issues/detail?id=148

Don't hesitate to file bugs against asan if you are sure there is a false
positive.


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:2>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:3>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new

Priority: low | Milestone:
Component: base | Version:

Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------

Comment(by ksserebr):

taking my words back, this is not an asan bug.
You should not use the version script with asan.
https://code.google.com/p/address-sanitizer/issues/detail?id=148#c5


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:3>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:4>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new

Priority: low | Milestone:
Component: base | Version:

Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------

Comment(by ettl.martin):

Thanks for file this bug on the asan tracker. My question is, how can i
now compile wxWidgets with asan and simultaniously avoid this issue int
the configuration?

Best regards

Martin


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:4>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:5>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

-------------------------+--------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: new

Priority: low | Milestone:
Component: base | Version:

Keywords: | Blockedby:
Patch: 0 | Blocking:
-------------------------+--------------------------------------------------

Comment(by ghostvoodooman):

Replying to [comment:3 ksserebr]:

> taking my words back, this is not an asan bug.
> You should not use the version script with asan.
> https://code.google.com/p/address-sanitizer/issues/detail?id=148#c5

I don't know whether this is related to this problem, but when I use on my
project memory sanitizer/analyser from Intel (proprietary product), it
reports I have access to uninitialized variable at project start-up (can't
remember where and what variable) but it was related to WX locale things.
And you mentioned `wxLocale`. Maybe the same issue. Anyway, my project
runs fine, but this should not be treated like negligible problem, and
when I will have some free time window, I will investigate this issue,
since though project runs fine, but this could be either bug or false-
positive.


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:5>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:6>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer

--------------------------+-------------------------------------------------
Reporter: ettl.martin | Owner:
Type: defect | Status: closed

Priority: low | Milestone:
Component: base | Version:

Resolution: invalid | Keywords:
Blockedby: | Patch: 0
Blocking: |
--------------------------+-------------------------------------------------
Changes (by vadz):

* status: new => closed
* resolution: => invalid


Comment:

Closing after the confirmation that it's not a problem in wx itself,
thanks to @ksserebr for investigating this!


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:6>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:7>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer
--------------------------+-------------------------------------------------

Reporter: ettl.martin | Owner:

Type: defect | Status: closed
Priority: low | Milestone:
Component: base | Version:

Resolution: invalid | Keywords:
Blockedby: | Patch: 0
Blocking: |
--------------------------+-------------------------------------------------

Comment(by ettl.martin):

Replying to [comment:6 vadz]:

> Closing after the confirmation that it's not a problem in wx itself,
thanks to @ksserebr for investigating this!

My question is, how can i now compile wxWidgets with asan and
simultaniously avoid this issue int the configuration?

--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:7>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:8>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer
--------------------------+-------------------------------------------------

Reporter: ettl.martin | Owner:

Type: defect | Status: closed
Priority: low | Milestone:
Component: base | Version:

Resolution: invalid | Keywords:
Blockedby: | Patch: 0
Blocking: |
--------------------------+-------------------------------------------------

Comment(by vadz):

One simple possibility would be to build it statically as the version
script is not used then. If you build it as shared library you'd need to
manually disable using the version script as there is no option to do it
now AFAIK.

Of course, is AS could work with version script it would be even better...


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:8>

[wxTrac]

Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:9>

#15010: False positives in wxString/wxCharBuffer code with address sanitizer
--------------------------+-------------------------------------------------

Reporter: ettl.martin | Owner:

Type: defect | Status: closed
Priority: low | Milestone:
Component: base | Version:

Resolution: invalid | Keywords:
Blockedby: | Patch: 0
Blocking: |
--------------------------+-------------------------------------------------

Comment(by ettl.martin):

Replying to [comment:8 vadz]:

> One simple possibility would be to build it statically as the version
script is not used then. If you build it as shared library you'd need to
manually disable using the version script as there is no option to do it
now AFAIK.
>
> Of course, is AS could work with version script it would be even
better...

Thank you


--
Ticket URL: <http://trac.wxwidgets.org/ticket/15010#comment:9>