simple valgrind test found what appear to be serious memory problems
Paul Eggert <[email protected]> Thu, 30 Sep 2010 00:41:47 -0700
| Newsgroups | gmane.comp.version-control.rcs.bugs |
|---|---|
| Organization | UCLA Computer Science Department |
| Message-ID | <[email protected]> |
After building the git version of tar, I tried a very simple test, namely I used "rlog" on an RCS file I had lying around, running it under valgrind. This found several problems, some of which appear to be serious. The number of problems in what should be an easy test to pass suggests that a code audit needs to be done. I am attaching a copy of the RCS file (compressed) and of the valgrind output. This was on x86-64 RHEL 5 with GCC 4.5.1.
INSTALL,v.gz
(application/x-gzip, 3 KB) - not displayed
valgrind.txt
(text/plain, 4.5 KB)
==11516== Memcheck, a memory error detector ==11516== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. ==11516== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info ==11516== Command: src/rlog /usr/local/cs/src/gcc/INSTALL ==11516== ==11516== Conditional jump or move depends on uninitialised value(s) ==11516== at 0x40B7E4: grok_all (b-grok.c:794) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Conditional jump or move depends on uninitialised value(s) ==11516== at 0x40B7C2: grok_all (b-grok.c:792) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Invalid read of size 8 ==11516== at 0x40A507: gethash (b-grok.c:501) ==11516== by 0x40AF43: grok_resynch (b-grok.c:832) ==11516== by 0x40B866: grok_all (b-grok.c:822) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== Address 0x4c3b770 is 48 bytes inside a block of size 4,064 free'd ==11516== at 0x4A05A31: free (vg_replace_malloc.c:325) ==11516== by 0x3FA5278E87: obstack_free (in /lib64/libc-2.5.so) ==11516== by 0x40483E: close_space (b-divvy.c:203) ==11516== by 0x40B85E: grok_all (b-grok.c:812) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Invalid read of size 8 ==11516== at 0x40AF49: grok_resynch (b-grok.c:834) ==11516== by 0x40B866: grok_all (b-grok.c:822) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== Address 0x4c3b788 is 72 bytes inside a block of size 4,064 free'd ==11516== at 0x4A05A31: free (vg_replace_malloc.c:325) ==11516== by 0x3FA5278E87: obstack_free (in /lib64/libc-2.5.so) ==11516== by 0x40483E: close_space (b-divvy.c:203) ==11516== by 0x40B85E: grok_all (b-grok.c:812) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Invalid read of size 8 ==11516== at 0x40A507: gethash (b-grok.c:501) ==11516== by 0x40AFD1: grok_resynch (b-grok.c:838) ==11516== by 0x40B866: grok_all (b-grok.c:822) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== Address 0x4c3b770 is 48 bytes inside a block of size 4,064 free'd ==11516== at 0x4A05A31: free (vg_replace_malloc.c:325) ==11516== by 0x3FA5278E87: obstack_free (in /lib64/libc-2.5.so) ==11516== by 0x40483E: close_space (b-divvy.c:203) ==11516== by 0x40B85E: grok_all (b-grok.c:812) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Invalid read of size 8 ==11516== at 0x40AF89: grok_resynch (b-grok.c:840) ==11516== by 0x40B866: grok_all (b-grok.c:822) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== Address 0x4c3b788 is 72 bytes inside a block of size 4,064 free'd ==11516== at 0x4A05A31: free (vg_replace_malloc.c:325) ==11516== by 0x3FA5278E87: obstack_free (in /lib64/libc-2.5.so) ==11516== by 0x40483E: close_space (b-divvy.c:203) ==11516== by 0x40B85E: grok_all (b-grok.c:812) ==11516== by 0x406566: pairnames (rcsfnms.c:384) ==11516== by 0x402A1F: main (rlog.c:924) ==11516== ==11516== Conditional jump or move depends on uninitialised value(s) ==11516== at 0x402694: putadelta (rlog.c:223) ==11516== by 0x403980: main (rlog.c:241) ==11516== ==11516== Conditional jump or move depends on uninitialised value(s) ==11516== at 0x402694: putadelta (rlog.c:223) ==11516== by 0x4027D9: putforest (rlog.c:274) ==11516== by 0x403993: main (rlog.c:1023) ==11516== ==11516== ==11516== HEAP SUMMARY: ==11516== in use at exit: 114,947 bytes in 13 blocks ==11516== total heap usage: 22 allocs, 9 frees, 127,499 bytes allocated ==11516== ==11516== LEAK SUMMARY: ==11516== definitely lost: 0 bytes in 0 blocks ==11516== indirectly lost: 0 bytes in 0 blocks ==11516== possibly lost: 4,064 bytes in 1 blocks ==11516== still reachable: 110,883 bytes in 12 blocks ==11516== suppressed: 0 bytes in 0 blocks ==11516== Rerun with --leak-check=full to see details of leaked memory ==11516== ==11516== For counts of detected and suppressed errors, rerun with: -v ==11516== Use --track-origins=yes to see where uninitialised values come from ==11516== ERROR SUMMARY: 45 errors from 8 contexts (suppressed: 4 from 4)