[Octave-bug-tracker] [bug #61280] mxDuplicateArray(...) has invalid write for sparse arrays, as reported by valgrind.

[Quazgar]

URL:
  <https://savannah.gnu.org/bugs/?61280>

                 Summary: mxDuplicateArray(...) has invalid write for sparse
arrays, as reported by valgrind.
                 Project: GNU Octave
            Submitted by: quazgar
            Submitted on: Mon 04 Oct 2021 03:14:34 PM UTC
                Category: None
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Segfault, Bus Error, etc.
                  Status: None
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
                 Release: 4.4.1
         Discussion Lock: Any
        Operating System: GNU/Linux

    _______________________________________________________

Details:

In mex code written by me, valgrind reports this:


[... debugging output indicating that this is a sparse array ...]
==23101== Thread 19 QThread:
==23101== Invalid write of size 8
==23101==    at 0x483C980: memmove (vg_replace_strmem.c:1270)
==23101==    by 0x59466BB: mxArray_sparse::dup() const (in
/usr/lib/x86_64-linux-gnu/liboctinterp.so.6.0.0)
==23101==    by 0x593BA38: mxDuplicateArray (in
/usr/lib/x86_64-linux-gnu/liboctinterp.so.6.0.0)
[... frames by my code ...]
==23101==  Address 0x3d24fef0 is 0 bytes after a block of size 0 alloc'd
==23101==    at 0x483577F: malloc (vg_replace_malloc.c:299)
==23101==    by 0x5939FBE: mxArray::malloc(unsigned long) (in
/usr/lib/x86_64-linux-gnu/liboctinterp.so.6.0.0)
==23101==    by 0x59465FE: mxArray_sparse::dup() const (in
/usr/lib/x86_64-linux-gnu/liboctinterp.so.6.0.0)
==23101==    by 0x593BA38: mxDuplicateArray (in
/usr/lib/x86_64-linux-gnu/liboctinterp.so.6.0.0)
[... frames by my code ...]


The code did not crash so far, but this does not look quite good.

mxDuplicateArray gets mxArray pointers, and when they point to empty, sparse
arrays, this behavior occurs.  The array in question was created like this:


mxArray *array = mxCreateSparse(0, 0, 0, mxREAL);





    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61280>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/