Double Free in libxam

[william...@clearpace.com]

Hi,

I am seeing an issue when linking executables to the XAM library along
with the other libraries we develop.

The valgrind output below indicates that certain statically
initialised instances of XAM classes are being destroyed twice at
exit. This could be down to some conflict with our libraries but I'm
having difficulty tracking it down. Have you seen this issue before?
Are you able to offer any advice?

Without running through valgrind, the code hangs in
malloc_consolidate.

Compiling with gcc 3.3.3 on SUSE Linux 9.2.

The executable source is simply (but linking to xam along with our own
libraries):

int main()
{

return 0;
}

Running through valgrind, I get the following output

[william.obrien@linux xamTest]$ valgrind ./test
==14917== Memcheck, a memory error detector.
==14917== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et
al.
==14917== Using LibVEX rev 1854, a library for dynamic binary
translation.
==14917== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==14917== Using valgrind-3.3.1, a dynamic binary instrumentation
framework.
==14917== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et
al.
==14917== For more details, rerun with: -v
==14917==
==14917== Invalid read of size 8
==14917== at 0x7FEF1D7: XAM_Properties::~XAM_Properties() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE0067: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x8B1498F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62360 is 64 bytes inside a block of size 72
free'd
==14917== at 0x4A1AA3C: operator delete(void*) (vg_replace_malloc.c:
342)
==14917== by 0x7FE006F: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE198F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid free() / delete / delete[]
==14917== at 0x4A1ADAE: free (vg_replace_malloc.c:323)
==14917== by 0x7FEEE68: XAM_POSIX::xam_free(void*) (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FEF1DF: XAM_Properties::~XAM_Properties() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE0067: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x8B1498F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62398 is 0 bytes inside a block of size 13
free'd
==14917== at 0x4A1ADAE: free (vg_replace_malloc.c:323)
==14917== by 0x7FEEE68: XAM_POSIX::xam_free(void*) (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FEF1DF: XAM_Properties::~XAM_Properties() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE0067: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE198F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid read of size 4
==14917== at 0x6A9AA40: pthread_mutex_destroy (in /lib64/tls/
libpthread.so.0)
==14917== by 0x7FEECE8:
XAM_POSIX::xam_mutex_destroy(pthread_mutex_t*) (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FEF1E8: XAM_Properties::~XAM_Properties() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE0067: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x8B1498F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62344 is 36 bytes inside a block of size 72
free'd
==14917== at 0x4A1AA3C: operator delete(void*) (vg_replace_malloc.c:
342)
==14917== by 0x7FE006F: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE198F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid read of size 4
==14917== at 0x7FEF1E9: XAM_Properties::~XAM_Properties() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE0067: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x8B1498F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62320 is 0 bytes inside a block of size 72
free'd
==14917== at 0x4A1AA3C: operator delete(void*) (vg_replace_malloc.c:
342)
==14917== by 0x7FE006F: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE198F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid free() / delete / delete[]
==14917== at 0x4A1AA3C: operator delete(void*) (vg_replace_malloc.c:
342)
==14917== by 0x7FE006F: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x8B1498F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62320 is 0 bytes inside a block of size 72
free'd
==14917== at 0x4A1AA3C: operator delete(void*) (vg_replace_malloc.c:
342)
==14917== by 0x7FE006F: XAM_LogState::~XAM_LogState() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FDEB24: XAM_LogFactory::~XAM_LogFactory() (in /home/
william.obrien/workspace/NParchive-dist/lib/libxam.so)
==14917== by 0x7FE198F: __tcf_1 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid free() / delete / delete[]
==14917== at 0x4A1A61E: operator delete[](void*)
(vg_replace_malloc.c:364)
==14917== by 0x8B3EFF9: __tcf_0 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d622a0 is 0 bytes inside a block of size 80
free'd
==14917== at 0x4A1A61E: operator delete[](void*)
(vg_replace_malloc.c:364)
==14917== by 0x800BFF9: __tcf_0 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid free() / delete / delete[]
==14917== at 0x4A1A61E: operator delete[](void*)
(vg_replace_malloc.c:364)
==14917== by 0x8B41766: __tcf_0 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x8B08FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x8B496D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam64.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x8d62220 is 0 bytes inside a block of size 80
free'd
==14917== at 0x4A1A61E: operator delete[](void*)
(vg_replace_malloc.c:364)
==14917== by 0x800E766: __tcf_0 (in /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5D3D: __cxa_finalize (in /lib64/tls/libc.so.6)
==14917== by 0x7FD5FC6: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x80166D0: (within /home/william.obrien/workspace/
NParchive-dist/lib/libxam.so)
==14917== by 0x86C5A4A: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917==
==14917== Invalid free() / delete / delete[]
==14917== at 0x4A1ADAE: free (vg_replace_malloc.c:323)
==14917== by 0x877C2F1: free_mem (in /lib64/tls/libc.so.6)
==14917== by 0x877BF91: __libc_freeres (in /lib64/tls/libc.so.6)
==14917== by 0x49178CB: _vgnU_freeres (vg_preloaded.c:60)
==14917== by 0x86C5A98: exit (in /lib64/tls/libc.so.6)
==14917== by 0x86B1AD3: (below main) (in /lib64/tls/libc.so.6)
==14917== Address 0x403c0a0 is not stack'd, malloc'd or (recently)
free'd
==14917==
==14917== ERROR SUMMARY: 9 errors from 8 contexts (suppressed: 8 from
5)
==14917== malloc/free: in use at exit: 253 bytes in 5 blocks.
==14917== malloc/free: 17 allocs, 18 frees, 4,725 bytes allocated.
==14917== For counts of detected errors, rerun with: -v
==14917== searching for pointers to 5 not-freed blocks.
==14917== checked 16,139,472 bytes.
==14917==
==14917== LEAK SUMMARY:
==14917== definitely lost: 253 bytes in 5 blocks.
==14917== possibly lost: 0 bytes in 0 blocks.
==14917== still reachable: 0 bytes in 0 blocks.
==14917== suppressed: 0 bytes in 0 blocks.
==14917== Rerun with --leak-check=full to see details of leaked
memory.

Kind Regards,

Will

[william...@clearpace.com]

Just realised:

I was linking against libxam64 and libxam_toolkit. However,
libxam_toolkit has an implied reference to libxam - which is the same
as libxam64 so I had links to both libxam and libxam64 in the binary
which I believe has caused my issue.

Regards,

Will

[Mike H]

Thanks Will.

Mike Horgan
EMC

> ...
>
> read more »