little bug on hdf_remove_tree()
马亮 <[email protected]> Wed, 3 Apr 2013 16:31:18 +0800 (CST)
| Newsgroups | gmane.text.clearsilver.general |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_191120_2127025161.1364977878612
Content-Type: text/plain; charset=GBK
Content-Transfer-Encoding: 7bit
hi,
It seems that hdf->last_hs, hdf->last_hp should set to NULL, if hdf_remove_tree() dealloced them.
following code can run normally, but valgrind detected one "Invalid read of size", so, please take a look:
(also viewable on https://gist.github.com/bigml/5299443)
int main(int argc, char **argv, char **envp)
{
HDF *node, *cnode;
hdf_init(&node);
hdf_set_value(node, "foo.0.pic", "xxx.jpg");
hdf_set_value(node, "bar.0.pic", "yyy.jpg");
cnode = hdf_get_child(node, "foo");
hdf_copy(node, "gifts.0", cnode);
cnode = hdf_get_child(node, "bar");
hdf_copy(node, "gifts.1", cnode);
hdf_remove_tree(node, "bar");
hdf_set_value(node, "zzzz", "4");
hdf_destroy(&node);
return 0;
}
this is the valgrind output:
[root@mdev demo]# valgrind --leak-check=full ./hdfremove
==16521== Memcheck, a memory error detector.
==16521== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==16521== Using LibVEX rev 1658, a library for dynamic binary translation.
==16521== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==16521== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==16521== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==16521== For more details, rerun with: -v
==16521==
==16521== Invalid read of size 8
==16521== at 0x41D653: _set_value (neo_hdf.c:675)
==16521== by 0x41E397: hdf_set_value (neo_hdf.c:829)
==16521== by 0x406382: main (hdfremove.c:22)
==16521== Address 0x6FE5558 is 48 bytes inside a block of size 112 free'd
==16521== at 0x4A0541E: free (vg_replace_malloc.c:233)
==16521== by 0x41CF43: _dealloc_hdf (neo_hdf.c:164)
==16521== by 0x41D0AA: hdf_remove_tree (neo_hdf.c:1018)
==16521== by 0x40636F: main (hdfremove.c:20)
==16521==
==16521== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 1)
==16521== malloc/free: in use at exit: 184 bytes in 2 blocks.
==16521== malloc/free: 33 allocs, 31 frees, 1,797 bytes allocated.
==16521== For counts of detected errors, rerun with: -v
==16521== searching for pointers to 2 not-freed blocks.
==16521== checked 792,216 bytes.
==16521==
==16521== LEAK SUMMARY:
==16521== definitely lost: 0 bytes in 0 blocks.
==16521== possibly lost: 0 bytes in 0 blocks.
==16521== still reachable: 184 bytes in 2 blocks.
==16521== suppressed: 0 bytes in 0 blocks.
==16521== Reachable blocks (those to which a pointer was found) are not shown.
==16521== To see them, rerun with: --show-reachable=yes
[root@mdev demo]#
------=_Part_191120_2127025161.1364977878612
Content-Type: text/html; charset=GBK
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
</head>
<body style="background-color: #fff;">
<span style="display:none"> </span>
<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position:relative;">
<div id="ygrp-msg" style="z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->
<div id="ygrp-text" >
<p><div style="color:#000000;font-size:14px;font-family:arial;">hi,<div> It seems that hdf->last_hs, hdf->last_hp should set to NULL, if hdf_remove_tree() dealloced them.<br><div> following code can run normally, but valgrind detected one "Invalid read of size", so, please take a look:</div><div> (also viewable on https://gist.github.com/bigml/5299443)</div><div><br></div><blockquote><div><div>int main(int argc, char **argv, char **envp)</div></div><div><div>{</div></div><div><div> HDF *node, *cnode;</div></div><div><div> hdf_init(&node);</div></div><div><div><br></div></div><div><div> hdf_set_value(node, "foo.0.pic", "xxx.jpg");</div></div><div><div> hdf_set_value(node, "bar.0.pic",
"yyy.jpg");</div></div><div><div><br></div></div><div><div> cnode = hdf_get_child(node, "foo");</div></div><div><div> hdf_copy(node, "gifts.0", cnode);</div></div><div><div><br></div></div><div><div> cnode = hdf_get_child(node, "bar");</div></div><div><div> hdf_copy(node, "gifts.1", cnode);</div></div><div><div><br></div></div><div><div> hdf_remove_tree(node, "bar");</div></div><div><div><br></div></div><div><div> hdf_set_value(node, "zzzz", "4");</div></div><div><div><br></div></div><div><div> hdf_destroy(&node);</div></div><div><div><br></div></div><div><div> return 0;</div></div><div><div>}</div></div></blockquote><div><br></div><div><br></div><div>this is the valgrind output:</
div><div><br></div></div><blockquote><div><div><div>[root@mdev demo]# valgrind --leak-check=full ./hdfremove</div></div></div><div><div><div>==16521== Memcheck, a memory error detector.</div></div></div><div><div><div>==16521== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.</div></div></div><div><div><div>==16521== Using LibVEX rev 1658, a library for dynamic binary translation.</div></div></div><div><div><div>==16521== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.</div></div></div><div><div><div>==16521== Using valgrind-3.2.1, a dynamic binary instrumentation framework.</div></div></div><div><div><div>==16521== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.</div></div></div><div><div><div>==16521== For more details, rerun with: -v</div></div
></div><div><div><div>==16521== </div></div></div><div><div><div>==16521== Invalid read of size 8</div></div></div><div><div><div>==16521== at 0x41D653: _set_value (neo_hdf.c:675)</div></div></div><div><div><div>==16521== by 0x41E397: hdf_set_value (neo_hdf.c:829)</div></div></div><div><div><div>==16521== by 0x406382: main (hdfremove.c:22)</div></div></div><div><div><div>==16521== Address 0x6FE5558 is 48 bytes inside a block of size 112 free'd</div></div></div><div><div><div>==16521== at 0x4A0541E: free (vg_replace_malloc.c:233)</div></div></div><div><div><div>==16521== by 0x41CF43: _dealloc_hdf (neo_hdf.c:164)</div></div></div><div><div><div>==16521== by 0x41D0AA: hdf_remove_tree (neo_hdf.c:1018)</d
iv></div></div><div><div><div>==16521== by 0x40636F: main (hdfremove.c:20)</div></div></div><div><div><div>==16521== </div></div></div><div><div><div>==16521== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 1)</div></div></div><div><div><div>==16521== malloc/free: in use at exit: 184 bytes in 2 blocks.</div></div></div><div><div><div>==16521== malloc/free: 33 allocs, 31 frees, 1,797 bytes allocated.</div></div></div><div><div><div>==16521== For counts of detected errors, rerun with: -v</div></div></div><div><div><div>==16521== searching for pointers to 2 not-freed blocks.</div></div></div><div><div><div>==16521== checked 792,216 bytes.</div></div></div><div><div><div>==16521== </div></div></div><div><div><div>==16521== LEAK SUMMARY:</div></div></div><d
iv><div><div>==16521== definitely lost: 0 bytes in 0 blocks.</div></div></div><div><div><div>==16521== possibly lost: 0 bytes in 0 blocks.</div></div></div><div><div><div>==16521== still reachable: 184 bytes in 2 blocks.</div></div></div><div><div><div>==16521== suppressed: 0 bytes in 0 blocks.</div></div></div><div><div><div>==16521== Reachable blocks (those to which a pointer was found) are not shown.</div></div></div><div><div><div>==16521== To see them, rerun with: --show-reachable=yes</div></div></div><div><div><div>[root@mdev demo]# </div></div></div></blockquote><div><div><br></div></div></div><br><br><span title="neteasefooter"><span id="netease_mail_footer"></span></span></p>
</div>
<!--~-|**|PrettyHtmlStart|**|-~-->
<div style="color: #fff; height: 0;">__._,_.___</div>
<table cellspacing=4px style="margin-top: 20px; margin-bottom: 10px;">
<tbody>
<tr>
<td style="font-size: 12px; font-family: arial; font-weight: bold; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA " >
<a style="text-decoration: none; color: #2D50FD" href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJwNW90MmI0BF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0NTEEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzY0OTc3ODk1?act=reply&messageNum=1451">Reply via web post</a>
</td>
<td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
<a href="mailto:[email protected]?subject=Re%3A%20little%20bug%20on%20hdf_remove_tree%28%29" style="text-decoration: none; color: #2D50FD;">
Reply to sender </a>
</td>
<td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; ">
<a href="mailto:[email protected]?subject=Re%3A%20little%20bug%20on%20hdf_remove_tree%28%29" style="text-decoration: none; color: #2D50FD">
Reply to group </a>
</td>
<td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #FFF; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
<a href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJlb2dyajFhBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTM2NDk3Nzg5NQ--" style="text-decoration: none; color: #2D50FD">Start a New Topic</a>
</td>
<td style="font-size: 12px; font-family: arial; padding: 7px 5px 5px; color: #2D50FD; background-color: #F2F2F2; border: 1px solid #EAEAEA; " >
<a href="http://groups.yahoo.com/group/ClearSilver/message/1451;_ylc=X3oDMTM0ZHZtMzQ5BF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0NTEEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzY0OTc3ODk1BHRwY0lkAzE0NTE-" style="text-decoration: none; color: #2D50FD;">Messages in this topic</a>
(1)
</td>
</tr>
</tbody>
</table>
<!------- Start Nav Bar ------>
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #f2f2f2; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; ">Recent Activity:</span>
<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
<div style="clear: both; padding-top: 2px; color: #1e66ae;">
<a href="http://groups.yahoo.com/group/ClearSilver;_ylc=X3oDMTJlcWtlajdlBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTM2NDk3Nzg5NQ--" style="text-decoration: none;">Visit Your Group</a>
</div>
</div>
<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="http://groups.yahoo.com/;_ylc=X3oDMTJkbGdzZm1mBF9TAzk3NDc2NTkwBGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzY0OTc3ODk1" style="float: left;"><img src="http://l.yimg.com/a/i/us/yg/logo/us.gif" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;">Switch to: <a href="mailto:[email protected]?subject=Change Delivery Format: Traditional" style="text-decoration: none;">Text-Only</a>, <a href="mailto:[email protected]?subject=Email Delivery: Digest" class="margin-rt" style="text-decoration: none;">Daily Digest</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="http://docs.yahoo.com/info/terms/" style="text-decoration: none;">Terms of Use</a> • <a href="mailto:[email protected]?subject=Feedback on the redesigned individual mail v1" style="text-decoration: none;">Send us Feedback </a></div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<!-- Sponsor -->
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;">
<!-- Start Recommendations -->
<div id="ygrp-reco">
</div>
<!-- End Recommendations -->
</div> <!-- |**|end egp html banner|**| -->
<div style="clear:both; color: #FFF; font-size:1px;">.</div>
</div>
<img src="http://geo.yahoo.com/serv?s=97359714/grpId=3564137/grpspId=1707281942/msgId=1451/stime=1364977895" width="1" height="1"> <br>
<div style="color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</body>
<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
<style type="text/css">
<!--
#ygrp-mkp {
border: 1px solid #d8d8d8;
font-family: Arial;
margin: 10px 0;
padding: 0 10px;
}
#ygrp-mkp hr {
border: 1px solid #d8d8d8;
}
#ygrp-mkp #hd {
color: #628c2a;
font-size: 85%;
font-weight: 700;
line-height: 122%;
margin: 10px 0;
}
#ygrp-mkp #ads {
margin-bottom: 10px;
}
#ygrp-mkp .ad {
padding: 0 0;
}
#ygrp-mkp .ad p {
margin: 0;
}
#ygrp-mkp .ad a {
color: #0000ff;
text-decoration: none;
}
#ygrp-sponsor #ygrp-lc {
font-family: Arial;
}
#ygrp-sponsor #ygrp-lc #hd {
margin: 10px 0px;
font-weight: 700;
font-size: 78%;
line-height: 122%;
}
#ygrp-sponsor #ygrp-lc .ad {
margin-bottom: 10px;
padding: 0 0;
}
#actions {
font-family: Verdana;
font-size: 11px;
padding: 10px 0;
}
#activity {
background-color: #e0ecee;
float: left;
font-family: Verdana;
font-size: 10px;
padding: 10px;
}
#activity span {
font-weight: 700;
}
#activity span:first-child {
text-transform: uppercase;
}
#activity span a {
color: #5085b6;
text-decoration: none;
}
#activity span span {
color: #ff7900;
}
#activity span .underline {
text-decoration: underline;
}
.attach {
clear: both;
display: table;
font-family: Arial;
font-size: 12px;
padding: 10px 0;
width: 400px;
}
.attach div a {
text-decoration: none;
}
.attach img {
border: none;
padding-right: 5px;
}
.attach label {
display: block;
margin-bottom: 5px;
}
.attach label a {
text-decoration: none;
}
blockquote {
margin: 0 0 0 4px;
}
.bold {
font-family: Arial;
font-size: 13px;
font-weight: 700;
}
.bold a {
text-decoration: none;
}
dd.last p a {
font-family: Verdana;
font-weight: 700;
}
dd.last p span {
margin-right: 10px;
font-family: Verdana;
font-weight: 700;
}
dd.last p span.yshortcuts {
margin-right: 0;
}
div.attach-table div div a {
text-decoration: none;
}
div.attach-table {
width: 400px;
}
div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited {
text-decoration: none;
}
div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited {
text-decoration: none;
}
div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
font-family: Verdana;
font-size: 10px;
font-weight: normal;
}
.green {
color: #628c2a;
}
.MsoNormal {
margin: 0 0 0 0;
}
o {
font-size: 0;
}
#photos div {
float: left;
width: 72px;
}
#photos div div {
border: 1px solid #666666;
height: 62px;
overflow: hidden;
width: 62px;
}
#photos div label {
color: #666666;
font-size: 10px;
overflow: hidden;
text-align: center;
white-space: nowrap;
width: 64px;
}
#reco-category {
font-size: 77%;
}
#reco-desc {
font-size: 77%;
}
.replbq {
margin: 4px;
}
#ygrp-actbar div a:first-child {
/* border-right: 0px solid #000;*/
margin-right: 2px;
padding-right: 5px;
}
#ygrp-mlmsg {
font-size: 13px;
font-family: Arial, helvetica,clean, sans-serif;
*font-size: small;
*font: x-small;
}
#ygrp-mlmsg table {
font-size: inherit;
font: 100%;
}
#ygrp-mlmsg select, input, textarea {
font: 99% Arial, Helvetica, clean, sans-serif;
}
#ygrp-mlmsg pre, code {
font:115% monospace;
*font-size:100%;
}
#ygrp-mlmsg * {
line-height: 1.22em;
}
#ygrp-mlmsg #logo {
padding-bottom: 10px;
}
#ygrp-msg p a {
font-family: Verdana;
}
#ygrp-msg p#attach-count span {
color: #1E66AE;
font-weight: 700;
}
#ygrp-reco #reco-head {
color: #ff7900;
font-weight: 700;
}
#ygrp-reco {
margin-bottom: 20px;
padding: 0px;
}
#ygrp-sponsor #ov li a {
font-size: 130%;
text-decoration: none;
}
#ygrp-sponsor #ov li {
font-size: 77%;
list-style-type: square;
padding: 6px 0;
}
#ygrp-sponsor #ov ul {
margin: 0;
padding: 0 0 0 8px;
}
#ygrp-text {
font-family: Georgia;
}
#ygrp-text p {
margin: 0 0 1em 0;
}
#ygrp-text tt {
font-size: 120%;
}
#ygrp-vital ul li:last-child {
border-right: none !important;
}
-->
</style>
</head>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->
------=_Part_191120_2127025161.1364977878612--