core dump on Mac: this_axis->ticfmt is freed twice

[Jun T. <tak...@kb...>]

On Mac OS X,

gnuplot> set term wxt
gnuplot> plot sin(x)

and on the plot window, use the arrow keys to move the plot,
and hit the 'u' key to unzoom. Then gnuplot core dumps as follows:

gnuplot(3264,0x7fff71afa310) malloc: *** error for object 0x7fdd21f5d5b0: pointer being freed was not allocated

The back trace is:

#0  0x00007fff84104866 in __pthread_kill ()
#1  0x00007fff8444235c in pthread_kill ()
#2  0x00007fff8bed8b1a in abort ()
#3  0x00007fff81c5f07f in free ()
#4  0x0000000107fb4ad1 in copy_or_invent_formatstring (this_axis=0x1081b1948) at axis.c:516
#5  0x0000000107fb5700 in setup_tics (this=0x1081b1948, max=20) at axis.c:886
#6  0x0000000107fbe2ac in boundary (plots=0x7fdd21fce620, count=1) at boundary.c:417
#7  0x0000000107fffa1f in do_plot (plots=0x7fdd21fce620, pcount=1) at graphics.c:533
#8  0x000000010804a30c in eval_plots () at plot2d.c:3335
#9  0x0000000108042b57 in plotrequest () at plot2d.c:271
#10 0x0000000107fc7033 in replotrequest () at command.c:2299
#11 0x0000000107fc6090 in do_string_replot (s=0x7fff57c4af10 "") at command.c:495
#12 0x00000001080397f1 in apply_zoom (z=0x7fdd21de8f80) at mouse.c:702
#13 0x000000010803a003 in ZoomUnzoom () at mouse.c:779
#14 0x000000010803835f in builtin_unzoom (ge=0x7fff57c4b468) at mouse.c:1242
...

The core dump is at

axis.c:516:    free(this_axis->ticfmt);

and the above error indicates that the memory pointed to by ticfmt has
already been freed.

This is due to that the value of this_axis->ticfmt is restored to the
saved value at

mouse.c:683:    memcpy(axis_array, axis_array_copy, sizeof(axis_array));

but the memory pointed to by the saved value of ticfmt has already been
freed.

On Linux, gnuplot may not core dump, but I believe it is just by sheer
luck. ticfmt is freed and allocated at

axis.c:516:    free(this_axis->ticfmt);
axis.c:517:    this_axis->ticfmt = strdup(tempfmt);

and, on Linux, I guess strdup() allocates the string in the memory which
has just been freed, and the value of ticfmt does not change.

The following would be a simple fix; i.e., do not restore ticfmt (and
formatstring) in apply_zoom().


Index: mouse.c
===================================================================
RCS file: /cvsroot/gnuplot/gnuplot/src/mouse.c,v
retrieving revision 1.179
diff -u -r1.179 mouse.c
--- mouse.c	24 Mar 2015 21:35:13 -0000	1.179
+++ mouse.c	20 Apr 2015 14:15:00 -0000
@@ -679,6 +679,8 @@
 	    axis_array_copy[i].label = axis_array[i].label;
 	    axis_array_copy[i].ticdef.def.user = axis_array[i].ticdef.def.user;
 	    axis_array_copy[i].ticdef.font = axis_array[i].ticdef.font;
+	    axis_array_copy[i].formatstring = axis_array[i].formatstring;
+	    axis_array_copy[i].ticfmt = axis_array[i].ticfmt;
 	}
 	memcpy(axis_array, axis_array_copy, sizeof(axis_array));
 	s[0] = '\0';	/* FIXME:  Is this better than calling replotrequest()? */