Skip to content

Access to previously freed memory #541

Closed
@scfc

Description

ledger accesses previously freed memory. I thought the issue was limited to 32-bit systems, but it is just hidden on 64-bit systems. valgrind diagnoses for the test case BaselineTest_opt-gain:

[tim@passepartout ~/src/ledger]$ valgrind --track-origins=yes ./ledger -f test/baseline/opt-gain.test reg --gain stocks; echo $?            
==26853== Memcheck, a memory error detector
==26853== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==26853== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==26853== Command: ./ledger -f test/baseline/opt-gain.test reg --gain stocks
==26853== 
==26853== Invalid read of size 1
==26853==    at 0x540FBFF: supports_flags<unsigned char, unsigned char>::has_flags(unsigned char) const (flags.h:78)
==26853==    by 0x54F820D: ledger::temporaries_t::clear() (temps.cc:128)
==26853==    by 0x543F4C3: ledger::temporaries_t::~temporaries_t() (temps.h:59)
==26853==    by 0x5459667: ledger::changed_value_posts::~changed_value_posts() (filters.h:605)
==26853==    by 0x54596AF: ledger::changed_value_posts::~changed_value_posts() (filters.h:608)
==26853==    by 0x5446EEC: void boost::checked_delete<ledger::changed_value_posts>(ledger::changed_value_posts*) (checked_delete.hpp:34)
==26853==    by 0x5448B5D: boost::detail::sp_counted_impl_p<ledger::changed_value_posts>::dispose() (sp_counted_impl.hpp:78)
==26853==    by 0x4C5E22: boost::detail::sp_counted_base::release() (sp_counted_base_std_atomic.hpp:109)
==26853==    by 0x4C5EAE: boost::detail::shared_count::~shared_count() (shared_count.hpp:473)
==26853==    by 0x53E605F: boost::shared_ptr<ledger::item_handler<ledger::post_t> >::~shared_ptr() (shared_ptr.hpp:336)
==26853==    by 0x53E6A93: ledger::item_handler<ledger::post_t>::~item_handler() (chain.h:67)
==26853==    by 0x5458F83: ledger::calc_posts::~calc_posts() (filters.h:413)
==26853==  Address 0xb1c5728 is 24 bytes inside a block of size 976 free'd
==26853==    at 0x4C2F1E8: operator delete(void*) (vg_replace_malloc.c:576)
==26853==    by 0x5448085: __gnu_cxx::new_allocator<std::_List_node<ledger::account_t> >::deallocate(std::_List_node<ledger::account_t>*, unsigned long) (new_allocator.h:125)
==26853==    by 0x5447DBE: std::allocator_traits<std::allocator<std::_List_node<ledger::account_t> > >::deallocate(std::allocator<std::_List_node<ledger::account_t> >&, std::_List_node<ledger::account_t>*, unsigned long) (alloc_traits.h:462)
==26853==    by 0x5447621: std::__cxx11::_List_base<ledger::account_t, std::allocator<ledger::account_t> >::_M_put_node(std::_List_node<ledger::account_t>*) (stl_list.h:387)
==26853==    by 0x544662C: std::__cxx11::_List_base<ledger::account_t, std::allocator<ledger::account_t> >::_M_clear() (list.tcc:80)
==26853==    by 0x54F923B: std::__cxx11::list<ledger::account_t, std::allocator<ledger::account_t> >::clear() (stl_list.h:1406)
==26853==    by 0x54F84A6: ledger::temporaries_t::clear() (temps.cc:142)
==26853==    by 0x543F4C3: ledger::temporaries_t::~temporaries_t() (temps.h:59)
==26853==    by 0x54593BB: ledger::display_filter_posts::~display_filter_posts() (filters.h:547)
==26853==    by 0x54593F3: ledger::display_filter_posts::~display_filter_posts() (filters.h:550)
==26853==    by 0x5446E82: void boost::checked_delete<ledger::display_filter_posts>(ledger::display_filter_posts*) (checked_delete.hpp:34)
==26853==    by 0x5448BA1: boost::detail::sp_counted_impl_p<ledger::display_filter_posts>::dispose() (sp_counted_impl.hpp:78)
==26853==  Block was alloc'd at
==26853==    at 0x4C2E1CA: operator new(unsigned long) (vg_replace_malloc.c:334)
==26853==    by 0x54FBCFC: __gnu_cxx::new_allocator<std::_List_node<ledger::account_t> >::allocate(unsigned long, void const*) (new_allocator.h:111)
==26853==    by 0x54FB703: std::allocator_traits<std::allocator<std::_List_node<ledger::account_t> > >::allocate(std::allocator<std::_List_node<ledger::account_t> >&, unsigned long) (alloc_traits.h:436)
==26853==    by 0x54FAF38: std::__cxx11::_List_base<ledger::account_t, std::allocator<ledger::account_t> >::_M_get_node() (stl_list.h:383)
==26853==    by 0x54FA4A2: std::_List_node<ledger::account_t>* std::__cxx11::list<ledger::account_t, std::allocator<ledger::account_t> >::_M_create_node<ledger::account_t>(ledger::account_t&&) (stl_list.h:572)
==26853==    by 0x54F982D: void std::__cxx11::list<ledger::account_t, std::allocator<ledger::account_t> >::_M_insert<ledger::account_t>(std::_List_iterator<ledger::account_t>, ledger::account_t&&) (stl_list.h:1801)
==26853==    by 0x54F8EA6: std::__cxx11::list<ledger::account_t, std::allocator<ledger::account_t> >::push_back(ledger::account_t&&) (stl_list.h:1123)
==26853==    by 0x54F7F59: ledger::temporaries_t::create_account(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, ledger::account_t*) (temps.cc:111)
==26853==    by 0x54594B2: ledger::display_filter_posts::create_accounts() (filters.h:554)
==26853==    by 0x544C99A: ledger::display_filter_posts::display_filter_posts(boost::shared_ptr<ledger::item_handler<ledger::post_t> >, ledger::report_t&, bool) (filters.cc:515)
==26853==    by 0x543D409: ledger::chain_post_handlers(boost::shared_ptr<ledger::item_handler<ledger::post_t> >, ledger::report_t&, bool) (chain.cc:148)
==26853==    by 0x5471450: ledger::report_t::posts_report(boost::shared_ptr<ledger::item_handler<ledger::post_t> >) (report.cc:349)
==26853== 
09-Jan-15 Commodities revalued                         <Revalued>                                                              100 P                      100 P
09-Feb-01 Commodities revalued                         <Revalued>                                                              200 P                      300 P
09-Feb-01 Sample 2a                                    Assets:Brokerage:Stocks                                                 300 P                      600 P
09-Mar-01 Commodities revalued                         <Revalued>                                                              800 P                     1400 P
09-Mar-01 Sample 3a                                    Assets:Brokerage:Stocks                                                 700 P                     2100 P
09-Apr-01 Commodities revalued                         <Revalued>                                                             2400 P                     4500 P
09-Apr-01 Sample 4a                                    Assets:Brokerage:Stocks                                               -1500 P                     3000 P
10-Feb-01 Commodities revalued                         <Revalued>                                                            -2400 P                      600 P
10-Feb-01 Sample 2b                                    Assets:Brokerage:Stocks                                                 300 P                      900 P
10-Mar-01 Commodities revalued                         <Revalued>                                                             1200 P                     2100 P
10-Mar-01 Sample 3b                                    Assets:Brokerage:Stocks                                                 700 P                     2800 P
10-Apr-01 Commodities revalued                         <Revalued>                                                             3200 P                     6000 P
10-Apr-01 Sample 4b                                    Assets:Brokerage:Stocks                                               -1500 P                     4500 P
==26853== 
==26853== HEAP SUMMARY:
==26853==     in use at exit: 212,024 bytes in 466 blocks
==26853==   total heap usage: 19,156 allocs, 18,690 frees, 2,029,638 bytes allocated
==26853== 
==26853== LEAK SUMMARY:
==26853==    definitely lost: 0 bytes in 0 blocks
==26853==    indirectly lost: 0 bytes in 0 blocks
==26853==      possibly lost: 0 bytes in 0 blocks
==26853==    still reachable: 212,024 bytes in 466 blocks
==26853==                       of which reachable via heuristic:
==26853==                         newarray           : 4,568 bytes in 7 blocks
==26853==                         multipleinheritance: 1,376 bytes in 1 blocks
==26853==         suppressed: 0 bytes in 0 blocks
==26853== Rerun with --leak-check=full to see details of leaked memory
==26853== 
==26853== For counts of detected and suppressed errors, rerun with: -v
==26853== ERROR SUMMARY: 7 errors from 1 contexts (suppressed: 0 from 0)
0
[tim@passepartout ~/src/ledger]$

(As output and exit code match the test expectations, this is not flagged during normal make check runs.)

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions