public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/60750] double free after std::move on string inside throw when compiled with optimization Date: Thu, 03 Apr 2014 18:19:00 -0000 [thread overview] Message-ID: <bug-60750-4-cLSPNLfjAb@http.gcc.gnu.org/bugzilla/> (raw) In-Reply-To: <bug-60750-4@http.gcc.gnu.org/bugzilla/> http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60750 Markus Trippelsdorf <trippels at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |trippels at gcc dot gnu.org --- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> --- -fsanitize=address shows: markus@x4 tmp % g++ -g -fsanitize=address -std=c++11 -O2 sample.cpp markus@x4 tmp % ./a.out ================================================================= ==568==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000eff0 at pc 0x4014b0 bp 0x7fff5e3564a0 sp 0x7fff5e356498 READ of size 4 at 0x60300000eff0 thread T0 #0 0x4014af in __exchange_and_add_single /var/tmp/gcc_test/usr/local/include/c++/4.9.0/ext/atomicity.h:67 #1 0x4014af in __exchange_and_add_dispatch /var/tmp/gcc_test/usr/local/include/c++/4.9.0/ext/atomicity.h:84 #2 0x4014af in std::string::_Rep::_M_dispose(std::allocator<char> const&) /var/tmp/gcc_test/usr/local/include/c++/4.9.0/bits/basic_string.h:246 #3 0x4011aa in std::string::_Rep::_M_dispose(std::allocator<char> const&) /var/tmp/gcc_test/usr/local/include/c++/4.9.0/bits/basic_string.h:240 #4 0x4011aa in ~basic_string /var/tmp/gcc_test/usr/local/include/c++/4.9.0/bits/basic_string.h:547 #5 0x4011aa in main /var/tmp/sample.cpp:13 #6 0x7f10d26e6faf in __libc_start_main (/lib/libc.so.6+0x1ffaf) #7 0x401354 (/var/tmp/a.out+0x401354) 0x60300000eff0 is located 16 bytes inside of 30-byte region [0x60300000efe0,0x60300000effe) freed by thread T0 here: #0 0x7f10d2d2bb97 in free (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/libasan.so.1+0x5eb97) #1 0x7f10d3b88809 in std::string::_Rep::_M_dispose(std::allocator<char> const&) /var/tmp/gcc_build_dir/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.h:249 #2 0x7f10d3b88809 in std::string::_M_mutate(unsigned long, unsigned long, unsigned long) /var/tmp/gcc_build_dir/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:487 previously allocated by thread T0 here: #0 0x7f10d2d2bdcf in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/libasan.so.1+0x5edcf) #1 0x7f10d3b28b97 in operator new(unsigned long) ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc:49 SUMMARY: AddressSanitizer: heap-use-after-free /var/tmp/gcc_test/usr/local/include/c++/4.9.0/ext/atomicity.h:67 __exchange_and_add_single Shadow bytes around the buggy address: 0x0c067fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c067fff9df0: fa fa fa fa fa fa fa fa fa fa fa fa fd fd[fd]fd 0x0c067fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==568==ABORTING markus@x4 tmp % g++ -g -fsanitize=address -std=c++11 -O1 sample.cpp markus@x4 tmp % ./a.out ================================================================= ==754==ERROR: AddressSanitizer: attempting double-free on 0x60300000efe0 in thread T0: #0 0x7f78aae87b97 in free (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/libasan.so.1+0x5eb97) #1 0x4012b6 in ~basic_string /var/tmp/gcc_test/usr/local/include/c++/4.9.0/bits/basic_string.h:547 #2 0x4012b6 in main /var/tmp/sample.cpp:13 #3 0x7f78aa842faf in __libc_start_main (/lib/libc.so.6+0x1ffaf) #4 0x401028 (/var/tmp/a.out+0x401028) 0x60300000efe0 is located 0 bytes inside of 30-byte region [0x60300000efe0,0x60300000effe) freed by thread T0 here: #0 0x7f78aae87b97 in free (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/libasan.so.1+0x5eb97) #1 0x7f78abce4809 in std::string::_Rep::_M_dispose(std::allocator<char> const&) /var/tmp/gcc_build_dir/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.h:249 #2 0x7f78abce4809 in std::string::_M_mutate(unsigned long, unsigned long, unsigned long) /var/tmp/gcc_build_dir/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:487 previously allocated by thread T0 here: #0 0x7f78aae87dcf in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.0/libasan.so.1+0x5edcf) #1 0x7f78abc84b97 in operator new(unsigned long) ../../../../gcc/libstdc++-v3/libsupc++/new_op.cc:49 SUMMARY: AddressSanitizer: double-free ??:0 free ==754==ABORTING markus@x4 tmp %
next prev parent reply other threads:[~2014-04-03 18:19 UTC|newest] Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-04-03 15:51 [Bug c++/60750] New: " sshannin at gmail dot com 2014-04-03 18:12 ` [Bug c++/60750] " redi at gcc dot gnu.org 2014-04-03 18:19 ` trippels at gcc dot gnu.org [this message] 2014-04-03 19:41 ` sshannin at gmail dot com 2014-04-04 9:43 ` [Bug c++/60750] [4.8/4.9 Regression] " rguenth at gcc dot gnu.org 2014-04-04 11:00 ` trippels at gcc dot gnu.org 2014-04-04 11:22 ` rguenth at gcc dot gnu.org 2014-04-04 11:37 ` rguenth at gcc dot gnu.org 2014-04-04 12:14 ` rguenth at gcc dot gnu.org 2014-04-07 8:39 ` rguenth at gcc dot gnu.org 2014-04-07 8:39 ` [Bug c++/60750] [4.8 " rguenth at gcc dot gnu.org 2014-05-05 13:49 ` rguenth at gcc dot gnu.org 2014-05-05 13:50 ` rguenth at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-60750-4-cLSPNLfjAb@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).