[Quantlib-dev] Handle memory problem

[Peter C. <pca...@gm...>]

Hello Luigi, all,

   I ran into a memory problem using a Handle<>, which I thought may
be worth sharing.
A version of the code producing the problem can be found below. In
fact I did not intend
to store a reference to the Handle in A, but rather a copy. Still the
code below looks
legal and reasonable to me, so maybe it is worth a second look?
Clang's address sanitizer
throws a message which I also paste below.

regards
   Peter


#include <ql/quantlib.hpp>
#include <iostream>

using namespace QuantLib;

struct A {

    A(const Handle<YieldTermStructure>&
b=Handle<YieldTermStructure>()) : b_(b) {}

    ~A() {}

    const Handle<YieldTermStructure>& b_;

};

int main(int, char**) {

    A a1;

    std::vector<boost::shared_ptr<A> > tmp;
    for(std::size_t i=0;i<100;i++)
       tmp.push_back(boost::shared_ptr<A>(new A()));

    std::cout << "the handle is "
              << (a1.b_.empty() ? "empty, which is ok" : "not empty,
why ?!?") << std::endl;

    return 0;

}


==30977==ERROR: AddressSanitizer: heap-use-after-free on address
0x60d00000cfe0 at pc 0x461c00 bp 0x7fff6aeee0d0 sp 0x7fff6aeee0c8
READ of size 8 at 0x60d00000cfe0 thread T0
    #0 0x461bff (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x461bff)
    #1 0x7fb4276a276c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    #2 0x4611fc (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x4611fc)
0x60d00000cfe0 is located 112 bytes inside of 136-byte region
[0x60d00000cf70,0x60d00000cff8)
freed by thread T0 here:
    #0 0x44eb65 (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x44eb65)
    #1 0x461421 (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x461421)
    #2 0x7fb4276a276c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
previously allocated by thread T0 here:
    #0 0x44e8a5 (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x44e8a5)
    #1 0x462ee8 (/home/peter/quantlibpc/QuantLib/Examples/Lmm/Lmm+0x462ee8)
Shadow bytes around the buggy address:
  0x0c1a7fff99a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a7fff99b0: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x0c1a7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c1a7fff99d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a7fff99e0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd
=>0x0c1a7fff99f0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa
  0x0c1a7fff9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==30977==ABORTING