Re: core dump on Mac: this_axis->ticfmt is freed twice

[Ethan A M. <sf...@us...>]

On Tuesday, 21 April, 2015 00:19:14 Jun T. wrote:
> On Mac OS X,
> 
> gnuplot> set term wxt
> gnuplot> plot sin(x)
> 
> and on the plot window, use the arrow keys to move the plot,
> and hit the 'u' key to unzoom. Then gnuplot core dumps as follows:
> 
> gnuplot(3264,0x7fff71afa310) malloc: *** error for object 0x7fdd21f5d5b0: pointer being freed was not allocated
> 
> The back trace is:
> 
> #0  0x00007fff84104866 in __pthread_kill ()
> #1  0x00007fff8444235c in pthread_kill ()
> #2  0x00007fff8bed8b1a in abort ()
> #3  0x00007fff81c5f07f in free ()
> #4  0x0000000107fb4ad1 in copy_or_invent_formatstring (this_axis=0x1081b1948) at axis.c:516
> #5  0x0000000107fb5700 in setup_tics (this=0x1081b1948, max=20) at axis.c:886
> #6  0x0000000107fbe2ac in boundary (plots=0x7fdd21fce620, count=1) at boundary.c:417
> #7  0x0000000107fffa1f in do_plot (plots=0x7fdd21fce620, pcount=1) at graphics.c:533
> #8  0x000000010804a30c in eval_plots () at plot2d.c:3335
> #9  0x0000000108042b57 in plotrequest () at plot2d.c:271
> #10 0x0000000107fc7033 in replotrequest () at command.c:2299
> #11 0x0000000107fc6090 in do_string_replot (s=0x7fff57c4af10 "") at command.c:495
> #12 0x00000001080397f1 in apply_zoom (z=0x7fdd21de8f80) at mouse.c:702
> #13 0x000000010803a003 in ZoomUnzoom () at mouse.c:779
> #14 0x000000010803835f in builtin_unzoom (ge=0x7fff57c4b468) at mouse.c:1242
> ...
> 
> The core dump is at
> 
> axis.c:516:    free(this_axis->ticfmt);
> 
> and the above error indicates that the memory pointed to by ticfmt has
> already been freed.
> 
> This is due to that the value of this_axis->ticfmt is restored to the
> saved value at
> 
> mouse.c:683:    memcpy(axis_array, axis_array_copy, sizeof(axis_array));
> 
> but the memory pointed to by the saved value of ticfmt has already been
> freed.
> 
> On Linux, gnuplot may not core dump, but I believe it is just by sheer
> luck. ticfmt is freed and allocated at
> 
> axis.c:516:    free(this_axis->ticfmt);
> axis.c:517:    this_axis->ticfmt = strdup(tempfmt);
> 
> and, on Linux, I guess strdup() allocates the string in the memory which
> has just been freed, and the value of ticfmt does not change.
> 
> The following would be a simple fix; i.e., do not restore ticfmt (and
> formatstring) in apply_zoom().
> 
> 
> Index: mouse.c
> ===================================================================
> RCS file: /cvsroot/gnuplot/gnuplot/src/mouse.c,v
> retrieving revision 1.179
> diff -u -r1.179 mouse.c
> --- mouse.c	24 Mar 2015 21:35:13 -0000	1.179
> +++ mouse.c	20 Apr 2015 14:15:00 -0000
> @@ -679,6 +679,8 @@
>  	    axis_array_copy[i].label = axis_array[i].label;
>  	    axis_array_copy[i].ticdef.def.user = axis_array[i].ticdef.def.user;
>  	    axis_array_copy[i].ticdef.font = axis_array[i].ticdef.font;
> +	    axis_array_copy[i].formatstring = axis_array[i].formatstring;
> +	    axis_array_copy[i].ticfmt = axis_array[i].ticfmt;
>  	}
>  	memcpy(axis_array, axis_array_copy, sizeof(axis_array));
>  	s[0] = '\0';	/* FIXME:  Is this better than calling replotrequest()? */


Yes, you are quite correct and I think the fix is correct also.

	thanks,

		Ethan