gnuplot-beta

segfault in plot3d

[James R. V. Z. <jr...@co...>]

I ran across a reliable segfault with the splot command, with the
current CVS code:

        G N U P L O T
        Version 4.3 patchlevel 0
        last modified February 2009

In particular, this is *without* my proposed changes to fit.c

Here's a run under the debugger:

gnuplot> splot 'lin2.dat',x+y
[New Thread 0xb7843a40 (LWP 27810)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7843a40 (LWP 27810)]
calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
(gdb) backtrace
#0  calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
#1  0x080a808c in plot3drequest () at plot3d.c:1909
#2  0x080571d7 in do_line () at command.c:595
#3  0x0805796d in com_line () at command.c:338
#4  0x0809a6dd in main (argc=1, argv=0xbffb35a4) at plot.c:659
(gdb) 

Here's lin2.dat:
---------------------------------------------
#octave:9> for x=[1:4];for y=[2:5]; fprintf('%f %f %f 1\n',x,y,10*x+2*y+randn);end;end
1.000000 2.000000 13.753875 1
1.000000 3.000000 15.843192 1
1.000000 4.000000 17.752269 1
1.000000 5.000000 18.819627 1


2.000000 2.000000 25.480149 1
2.000000 3.000000 26.217588 1
2.000000 4.000000 28.555638 1
2.000000 5.000000 30.757950 1


3.000000 2.000000 33.879955 1
3.000000 3.000000 36.190724 1
3.000000 4.000000 39.199289 1
3.000000 5.000000 40.153219 1


4.000000 2.000000 43.413695 1
4.000000 3.000000 45.938903 1
4.000000 4.000000 49.196757 1
4.000000 5.000000 50.136290 1
#octave:10> diary off
-----------------------------------------


All these commands work fine:

   gnuplot> splot 'fit2.dat'
   gnuplot> splot x+y
   gnuplot> splot x+y,'fit2.dat'

It only fails when plotting the data file first, then the function.
I've had other data files fail, but demo/glasses.dat succeeds.

I set a breakpoint at plot3d.c:1174 in calculate_set_of_isolines() and
followed execution.  When j=0 and i=99, the function reaches end of
the linked list, sets this_iso to zero, then sets points to zero.  The
next time through when j=1 and i=0, the function dies trying to access
points[i].x.  I haven't been able to identify the cause.

I have a couple of other binaries installed.
This version also crashes:
        G N U P L O T
        Version 4.3 patchlevel 0
        last modified January 2007

This version is okay:
        G N U P L O T
        Version 4.2 patchlevel 4 
        last modified Sep 2008


Does anyone else see this?

     - Jim Van Zandt

Re: segfault in plot3d

[Ethan A M. <merritt@u.washington.edu>]

On Tuesday 17 February 2009, James R. Van Zandt wrote:
> 
> I ran across a reliable segfault with the splot command, with the
> current CVS code:
> 
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified February 2009

I can reproduce the bug.
I bisected it back to a single patch to plot3d on 20-Oct-2006.
The patch added support for iteration.  

http://gnuplot.cvs.sourceforge.net/viewvc/gnuplot/gnuplot/src/plot3d.c?r1=1.132&r2=1.133&view=patch

And there I lose it.  I can't see what that check for iteration has to do with this crash.
There is no iteration in the command that triggers the crash, so the iteration
code should not do anything at all.  Yet reverting that one set of checks makes the
crash go away.

Can anyone else see what is going on?

	Ethan


 
> In particular, this is *without* my proposed changes to fit.c
> 
> Here's a run under the debugger:
> 
> gnuplot> splot 'lin2.dat',x+y
> [New Thread 0xb7843a40 (LWP 27810)]
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 0xb7843a40 (LWP 27810)]
> calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> (gdb) backtrace
> #0  calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> #1  0x080a808c in plot3drequest () at plot3d.c:1909
> #2  0x080571d7 in do_line () at command.c:595
> #3  0x0805796d in com_line () at command.c:338
> #4  0x0809a6dd in main (argc=1, argv=0xbffb35a4) at plot.c:659
> (gdb) 
> 
> Here's lin2.dat:
> ---------------------------------------------
> #octave:9> for x=[1:4];for y=[2:5]; fprintf('%f %f %f 1\n',x,y,10*x+2*y+randn);end;end
> 1.000000 2.000000 13.753875 1
> 1.000000 3.000000 15.843192 1
> 1.000000 4.000000 17.752269 1
> 1.000000 5.000000 18.819627 1
> 
> 
> 2.000000 2.000000 25.480149 1
> 2.000000 3.000000 26.217588 1
> 2.000000 4.000000 28.555638 1
> 2.000000 5.000000 30.757950 1
> 
> 
> 3.000000 2.000000 33.879955 1
> 3.000000 3.000000 36.190724 1
> 3.000000 4.000000 39.199289 1
> 3.000000 5.000000 40.153219 1
> 
> 
> 4.000000 2.000000 43.413695 1
> 4.000000 3.000000 45.938903 1
> 4.000000 4.000000 49.196757 1
> 4.000000 5.000000 50.136290 1
> #octave:10> diary off
> -----------------------------------------
> 
> 
> All these commands work fine:
> 
>    gnuplot> splot 'fit2.dat'
>    gnuplot> splot x+y
>    gnuplot> splot x+y,'fit2.dat'
> 
> It only fails when plotting the data file first, then the function.
> I've had other data files fail, but demo/glasses.dat succeeds.
> 
> I set a breakpoint at plot3d.c:1174 in calculate_set_of_isolines() and
> followed execution.  When j=0 and i=99, the function reaches end of
> the linked list, sets this_iso to zero, then sets points to zero.  The
> next time through when j=1 and i=0, the function dies trying to access
> points[i].x.  I haven't been able to identify the cause.
> 
> I have a couple of other binaries installed.
> This version also crashes:
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified January 2007
> 
> This version is okay:
>         G N U P L O T
>         Version 4.2 patchlevel 4 
>         last modified Sep 2008
> 
> 
> Does anyone else see this?
> 
>      - Jim Van Zandt
> 
> ------------------------------------------------------------------------------
> Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
> -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
> -Strategies to boost innovation and cut costs with open source participation
> -Receive a $600 discount off the registration fee with the source code: SFAD
> http://p.sf.net/sfu/XcvMzF8H
> _______________________________________________
> gnuplot-beta mailing list
> gnu...@li...
> https://lists.sourceforge.net/lists/listinfo/gnuplot-beta
> 



-- 
Ethan A Merritt
Biomolecular Structure Center
University of Washington, Seattle 98195-7742

Re: segfault in plot3d

[Ethan A M. <merritt@u.washington.edu>]

On Tuesday 17 February 2009, James R. Van Zandt wrote:
> 
> I ran across a reliable segfault with the splot command, with the
> current CVS code:
> 
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified February 2009
> 
> In particular, this is *without* my proposed changes to fit.c
> 
> Here's a run under the debugger:
> 
> gnuplot> splot 'lin2.dat',x+y

Why does your data file have two blank lines between each set of points?

If you reduce that to a single blank line then there is no segfault.
Of course, it should not segfault in any case, but I'm wondering if
this is why no one has reported the problem before.

	Ethan



> [New Thread 0xb7843a40 (LWP 27810)]
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 0xb7843a40 (LWP 27810)]
> calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> (gdb) backtrace
> #0  calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> #1  0x080a808c in plot3drequest () at plot3d.c:1909
> #2  0x080571d7 in do_line () at command.c:595
> #3  0x0805796d in com_line () at command.c:338
> #4  0x0809a6dd in main (argc=1, argv=0xbffb35a4) at plot.c:659
> (gdb) 
> 
> Here's lin2.dat:
> ---------------------------------------------
> #octave:9> for x=[1:4];for y=[2:5]; fprintf('%f %f %f 1\n',x,y,10*x+2*y+randn);end;end
> 1.000000 2.000000 13.753875 1
> 1.000000 3.000000 15.843192 1
> 1.000000 4.000000 17.752269 1
> 1.000000 5.000000 18.819627 1
> 
> 
> 2.000000 2.000000 25.480149 1
> 2.000000 3.000000 26.217588 1
> 2.000000 4.000000 28.555638 1
> 2.000000 5.000000 30.757950 1
> 
> 
> 3.000000 2.000000 33.879955 1
> 3.000000 3.000000 36.190724 1
> 3.000000 4.000000 39.199289 1
> 3.000000 5.000000 40.153219 1
> 
> 
> 4.000000 2.000000 43.413695 1
> 4.000000 3.000000 45.938903 1
> 4.000000 4.000000 49.196757 1
> 4.000000 5.000000 50.136290 1
> #octave:10> diary off
> -----------------------------------------
> 
> 
> All these commands work fine:
> 
>    gnuplot> splot 'fit2.dat'
>    gnuplot> splot x+y
>    gnuplot> splot x+y,'fit2.dat'
> 
> It only fails when plotting the data file first, then the function.
> I've had other data files fail, but demo/glasses.dat succeeds.
> 
> I set a breakpoint at plot3d.c:1174 in calculate_set_of_isolines() and
> followed execution.  When j=0 and i=99, the function reaches end of
> the linked list, sets this_iso to zero, then sets points to zero.  The
> next time through when j=1 and i=0, the function dies trying to access
> points[i].x.  I haven't been able to identify the cause.
> 
> I have a couple of other binaries installed.
> This version also crashes:
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified January 2007
> 
> This version is okay:
>         G N U P L O T
>         Version 4.2 patchlevel 4 
>         last modified Sep 2008
> 
> 
> Does anyone else see this?
> 
>      - Jim Van Zandt
> 
> ------------------------------------------------------------------------------
> Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA
> -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise
> -Strategies to boost innovation and cut costs with open source participation
> -Receive a $600 discount off the registration fee with the source code: SFAD
> http://p.sf.net/sfu/XcvMzF8H
> _______________________________________________
> gnuplot-beta mailing list
> gnu...@li...
> https://lists.sourceforge.net/lists/listinfo/gnuplot-beta
> 



-- 
Ethan A Merritt
Biomolecular Structure Center
University of Washington, Seattle 98195-7742

Re: segfault in plot3d

[Daniel J S. <dan...@ie...>]

Ethan A Merritt wrote:

>>gnuplot> splot 'lin2.dat',x+y
> 
> 
> Why does your data file have two blank lines between each set of points?
> 
> If you reduce that to a single blank line then there is no segfault.
> Of course, it should not segfault in any case, but I'm wondering if
> this is why no one has reported the problem before.

That explains it.  The double line break means to start another 3D curve.  (A single break means to start another trace of the 3D curve.)  So Jim's example is attempting a 3D plot with single dimensioned data.

I tried doing such a thing with functions rather than data, but notice that

gnuplot> set samples 100, 1
                           ^
         sampling rate must be > 1; sampling unchanged

prevents one from even doing so.  Either a check should be put in plot3d.c, or a datafile should be disallowed similar to the above gnuplot error message.

Dan

Re: segfault in plot3d

[Ethan A M. <merritt@u.washington.edu>]

On Tuesday 17 February 2009, James R. Van Zandt wrote:
> 
> I ran across a reliable segfault with the splot command, with the
> current CVS code:

There is now a fix for this problem in CVS.

	Ethan



> 
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified February 2009
> 
> In particular, this is *without* my proposed changes to fit.c
> 
> Here's a run under the debugger:
> 
> gnuplot> splot 'lin2.dat',x+y
> [New Thread 0xb7843a40 (LWP 27810)]
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 0xb7843a40 (LWP 27810)]
> calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> (gdb) backtrace
> #0  calculate_set_of_isolines (value_axis=FIRST_Z_AXIS, cross=false, this_iso=0xbffb32e0, iso_axis=FIRST_Y_AXIS, iso_min=2, iso_step=0.33333333333333331, num_iso_to_use=10, sam_axis=FIRST_X_AXIS, sam_min=1, sam_step=0.030303030303030304, num_sam_to_use=100, need_palette=false) at plot3d.c:1174
> #1  0x080a808c in plot3drequest () at plot3d.c:1909
> #2  0x080571d7 in do_line () at command.c:595
> #3  0x0805796d in com_line () at command.c:338
> #4  0x0809a6dd in main (argc=1, argv=0xbffb35a4) at plot.c:659
> (gdb) 
> 
> Here's lin2.dat:
> ---------------------------------------------
> #octave:9> for x=[1:4];for y=[2:5]; fprintf('%f %f %f 1\n',x,y,10*x+2*y+randn);end;end
> 1.000000 2.000000 13.753875 1
> 1.000000 3.000000 15.843192 1
> 1.000000 4.000000 17.752269 1
> 1.000000 5.000000 18.819627 1
> 
> 
> 2.000000 2.000000 25.480149 1
> 2.000000 3.000000 26.217588 1
> 2.000000 4.000000 28.555638 1
> 2.000000 5.000000 30.757950 1
> 
> 
> 3.000000 2.000000 33.879955 1
> 3.000000 3.000000 36.190724 1
> 3.000000 4.000000 39.199289 1
> 3.000000 5.000000 40.153219 1
> 
> 
> 4.000000 2.000000 43.413695 1
> 4.000000 3.000000 45.938903 1
> 4.000000 4.000000 49.196757 1
> 4.000000 5.000000 50.136290 1
> #octave:10> diary off
> -----------------------------------------
> 
> 
> All these commands work fine:
> 
>    gnuplot> splot 'fit2.dat'
>    gnuplot> splot x+y
>    gnuplot> splot x+y,'fit2.dat'
> 
> It only fails when plotting the data file first, then the function.
> I've had other data files fail, but demo/glasses.dat succeeds.
> 
> I set a breakpoint at plot3d.c:1174 in calculate_set_of_isolines() and
> followed execution.  When j=0 and i=99, the function reaches end of
> the linked list, sets this_iso to zero, then sets points to zero.  The
> next time through when j=1 and i=0, the function dies trying to access
> points[i].x.  I haven't been able to identify the cause.
> 
> I have a couple of other binaries installed.
> This version also crashes:
>         G N U P L O T
>         Version 4.3 patchlevel 0
>         last modified January 2007
> 
> This version is okay:
>         G N U P L O T
>         Version 4.2 patchlevel 4 
>         last modified Sep 2008
> 
> 
> Does anyone else see this?
> 
>      - Jim Van Zandt
> 


-- 
Ethan A Merritt

Re: segfault in plot3d

[Daniel J S. <dan...@ie...>]

Ethan A Merritt wrote:
> On Tuesday 17 February 2009, James R. Van Zandt wrote:
> 
>>I ran across a reliable segfault with the splot command, with the
>>current CVS code:
> 
> 
> There is now a fix for this problem in CVS.
> 
> 	Ethan

I see now.  The fix works.

I'd say though that the hunk of code as it existed (exists) wasn't as clean as it could have been.  For example, the addition of this line:

@@ -1743,6 +1743,7 @@

                    this_plot->plot_type = DATA3D;
                    this_plot->plot_style = this_style;
+                   this_plot->iteration = iteration;
                    /* Struct copy */
                    this_plot->lp_properties = *these_props;

likely isn't needed because next time through the loop "this_plot->iteration = iteration" is done higher up in the while do/while loop.  (Global "iteration" is modified by the parse.c code, none of which is called here so global "iteration" should not change in between the two assignments.)

In fact, the "while (df_return != DF_EOF)" won't have a chance to fail because higher in the loop is a break statement

		    if (df_return == DF_EOF)
			break;

Going a little higher up in the loop is

		do {
		    this_plot = *tp_3d_ptr;

but this is extraneous because notice a few lines before this is

	    assert(this_plot == *tp_3d_ptr);

and at the bottom of the loop is

		    if ((this_plot = *tp_3d_ptr) != NULL) {
			if (this_plot->title) {
			    free(this_plot->title);
			    this_plot->title = NULL;
			}
		    } else {
			/* Allocate enough isosamples and samples */
			this_plot = *tp_3d_ptr = sp_alloc(0, 0, 0, 0);
		    }

so it is certain that "this_plot == *tp_3d_ptr".

Dan

Re: segfault in plot3d

[Daniel J S. <dan...@ie...>]

Daniel J Sebald wrote:

> I'd say though that the hunk of code as it existed (exists) wasn't as
> clean as it could have been.  For example, the addition of this line:

Ethan,

Give this patch a try.  I cleans up the loop and groups iteration earlier the way it is grouped inside the loop.  As for the "Fixme" question, I do think recording the iteration is necessary.

All demos still pass after this patch is applied.

Dan