[bug #68245] Use-After-Free and Double-Free errors with polymorphic allocator enabled

bytemare <[email protected]> Wed, 15 Apr 2026 07:03:08 -0400 (EDT)
Newsgroups	gmane.comp.gnu.octave.bugs
Message-ID	<[email protected]>
Please use the bug tracker to post updates to a bug report.  The mailing list is intended as a read-only notification stream.  Info posted to this mailing list address won't appear in the tracker database where it is most useful.

URL:
  <https://savannah.gnu.org/bugs/?68245>

                 Summary: Use-After-Free and Double-Free errors with
polymorphic allocator enabled
                   Group: GNU Octave
               Submitter: bytemare
               Submitted: Wed 15 Apr 2026 11:03:01 AM UTC
                Category: Interpreter
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Segfault, Bus Error, etc.
                  Status: None
             Assigned to: None
         Originator Name:
        Originator Email:
             Open/Closed: Open
         Discussion Lock: Unlocked
                 Release: dev
        Operating System: Any
           Fixed Release: None
         Planned Release: None


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Wed 15 Apr 2026 11:03:01 AM UTC By: bytemare <bytemare>
In short, there are issues with memory allocation / deallocation in the MEX
context.

I compared versions 9 and 10 since the issue started manifesting with this
version change. Version 11 (and the latest GIT code) is affected as well. I
asked Claude to perform the analysis of what is going on, and myself not being
familiar with the code, it seems to me it did quite well.

Issue 1. In case of singles and doubles the mexPutVariable does not copy the
data and the pointer is freed by the ~mex() destructor. When printing the
variable it shows random garbage (different with every print).

Issue 2. After applying patch 0001 there is another problem manifested upon
exit. This is something I found accidentally. When one mxAlloc-ed array is
used more than once as a mexPutVariable argument upon leaving Octave it tries
to free the same pointer twice and crashes.

Attached:
- a small example to reproduce the issues.
- two patches for the current development version of Octave
- Claude's reasoning behind the patches







    _______________________________________________________
File Attachments:

Name: example.c                      Size: 647B
    <https://file.savannah.gnu.org/file/example.c?file_id=58470>

Name: 0002-Fix-double-free-for-multi-mexPutVariable-with-same-p.patch Size:
3.1KiB

<https://file.savannah.gnu.org/file/0002-Fix-double-free-for-multi-mexPutVariable-with-same-p.patch?file_id=58471>

Name: summary.md                     Size: 22KiB
    <https://file.savannah.gnu.org/file/summary.md?file_id=58472>

Name: 0001-Fix-use-after-free-in-mexPutVariable.patch Size: 2.8KiB

<https://file.savannah.gnu.org/file/0001-Fix-use-after-free-in-mexPutVariable.patch?file_id=58473>



    AGPL NOTICE

These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://savannah.gnu.org/source/savane-f290f6b25beb8cb99bbe243a6cd2c5fef79ffcde.tar.gz

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?68245>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc (application/pgp-signature, 228 B)