public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libstdc++/16655] New: Segmentation fault in the std::ofstream destructor
@ 2004-07-21  9:49 Serguei dot Kolos at cern dot ch
  2004-07-21 19:29 ` [Bug libstdc++/16655] " pinskia at gcc dot gnu dot org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Serguei dot Kolos at cern dot ch @ 2004-07-21  9:49 UTC (permalink / raw)
  To: gcc-bugs

On some file systems (for example on AFS), the ofstream destructor crashes the
application if there is no space left on that FS. This happens because it calls
the fclose() function 2 times. 
In more details the problem is that in case of no space left on AFS the fflush()
succeeds and only fclose() fails. In this case:

1. the __basic_file<char>::close() is called twice - first time by the
basic_filebuf<char, std::char_traits<char> >::close() and second time by the
__basic_file<char> destructor.
2. in the first call the fclose() fails and the _M_cfile is not set to 0.
3. in the second call __basic_file<char>::is_open() returns true because the
_M_cfile is not 0 and the fclose() is called second time and tries to use the
memory which was already freed by the previous invocation of the fclose().
4. Program crashes.

Here is the program, which reproduces the bug:

#include <fstream>
#include <iostream>

using namespace std;

int main()
{
    ofstream foo( "foo.bar", std::ios::out | std::ios::trunc );
    
    for ( int i = 0; i < 1000000; i++ )
	foo << "hello";
    
    cout << "foo.good() = " << foo.good() << endl;
    cout << "foo.bad() = " << foo.bad() << endl;
    cout << "foo.eof() = " << foo.eof() << endl;
    cout << "foo.fail() = " << foo.fail() << endl << endl;
    
    foo.flush();
    
    cout << "foo.good() = " << foo.good() << endl;
    cout << "foo.bad() = " << foo.bad() << endl;
    cout << "foo.eof() = " << foo.eof() << endl;
    cout << "foo.fail() = " << foo.fail() << endl << endl;
    
    foo.close();
    
    cout << "foo.good() = " << foo.good() << endl;
    cout << "foo.bad() = " << foo.bad() << endl;
    cout << "foo.eof() = " << foo.eof() << endl;
    cout << "foo.fail() = " << foo.fail() << endl;
    
    return 0;
}


The output is (on AFS with not enough space left):

foo.good() = 1
foo.bad() = 0
foo.eof() = 0
foo.fail() = 0

foo.good() = 1
foo.bad() = 0
foo.eof() = 0
foo.fail() = 0

foo.good() = 0
foo.bad() = 0
foo.eof() = 0
foo.fail() = 1
Segmentation fault (core dumped)

The problem does not appear for a local file system because in this case the
fflush() fails and destructor works correctly.

-- 
           Summary: Segmentation fault in the std::ofstream destructor
           Product: gcc
           Version: 3.2
            Status: UNCONFIRMED
          Severity: critical
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: Serguei dot Kolos at cern dot ch
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i386-pc-linux-gnu
  GCC host triplet: i386-pc-linux-gnu
GCC target triplet: i386-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=16655


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-08-16  7:57 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2004-07-21  9:49 [Bug libstdc++/16655] New: Segmentation fault in the std::ofstream destructor Serguei dot Kolos at cern dot ch
2004-07-21 19:29 ` [Bug libstdc++/16655] " pinskia at gcc dot gnu dot org
2004-07-30  9:30 ` pcarlini at suse dot de
2004-08-16  0:33 ` giovannibajo at libero dot it
2004-08-16  7:52 ` Serguei dot Kolos at cern dot ch
2004-08-16  7:57 ` pinskia at gcc dot gnu dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).