public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource
@ 2020-05-01 17:42 arnaud02 at users dot sourceforge.net
2020-05-01 18:19 ` [Bug libstdc++/94906] " redi at gcc dot gnu.org
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: arnaud02 at users dot sourceforge.net @ 2020-05-01 17:42 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
Bug ID: 94906
Summary: memory corruption in std::pmr::memory_buffer_resource
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: libstdc++
Assignee: unassigned at gcc dot gnu.org
Reporter: arnaud02 at users dot sourceforge.net
Target Milestone: ---
>cat pmr1.cpp
#include <array>
#include <memory_resource>
#include <unordered_map>
int main() {
const std::size_t max_size = 75'000'000;
std::pmr::monotonic_buffer_resource res;
std::pmr::unordered_map<int, std::array<char,32>> counter{&res};
for (size_t i = 0; i < max_size; ++i) counter[i];
}
>g++ -Wall -std=c++17 -O2 -g pmr1.cpp && ./a.out
*** Error in `./a.out': free(): invalid pointer: 0x00002b06379d000f ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81299)[0x2b03c8a6f299]
opt/gcc/gcc-930-rh7/lib64/libstdc++.so.6(_ZNSt3pmr25monotonic_buffer_resource18_M_release_buffersEv+0x48)[0x2b03c825fe78]
opt/gcc/gcc-930-rh7/lib64/libstdc++.so.6(_ZNSt3pmr25monotonic_buffer_resourceD2Ev+0x1e)[0x2b03c825febe]
./a.out[0x400d51]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x2b03c8a10555]
./a.out[0x400eb4]
In monotonic_buffer_resource::_Chunk::release, "__size" is not calculated
properly when _Chunk::_M_size is 32 or more. Here is a candidate patch:
--- gcc-9.3.0/libstdc++-v3/src/c++17/memory_resource.cc 2020-03-12
11:07:24.000000000 +0000
+++ gcc-9.3.0/libstdc++-v3/src/c++17/memory_resource.cc.new 2020-05-01
18:31:24.367672036 +0100
@@ -228,7 +228,7 @@
if (__ch->_M_canary != (__ch->_M_size | __ch->_M_align))
return; // buffer overflow detected!
- size_t __size = (1u << __ch->_M_size);
+ size_t __size = (1lu << __ch->_M_size);
size_t __align = (1u << __ch->_M_align);
void* __start = (char*)(__ch + 1) - __size;
__r->deallocate(__start, __size, __align);
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::memory_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
@ 2020-05-01 18:19 ` redi at gcc dot gnu.org
2020-05-01 18:46 ` pinskia at gcc dot gnu.org
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: redi at gcc dot gnu.org @ 2020-05-01 18:19 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2020-05-01
Status|UNCONFIRMED |ASSIGNED
Assignee|unassigned at gcc dot gnu.org |redi at gcc dot gnu.org
Keywords| |wrong-code
Ever confirmed|0 |1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::memory_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
2020-05-01 18:19 ` [Bug libstdc++/94906] " redi at gcc dot gnu.org
@ 2020-05-01 18:46 ` pinskia at gcc dot gnu.org
2020-05-04 21:48 ` [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource cvs-commit at gcc dot gnu.org
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: pinskia at gcc dot gnu.org @ 2020-05-01 18:46 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Better would be:
size_t __size = (((size_t)1) << __ch->_M_size);
As long could be 32bits (windows)
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
2020-05-01 18:19 ` [Bug libstdc++/94906] " redi at gcc dot gnu.org
2020-05-01 18:46 ` pinskia at gcc dot gnu.org
@ 2020-05-04 21:48 ` cvs-commit at gcc dot gnu.org
2020-05-05 16:18 ` redi at gcc dot gnu.org
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2020-05-04 21:48 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:
https://gcc.gnu.org/g:bb27781b64162e1769df15e0c97e8d2145d2d10d
commit r11-53-gbb27781b64162e1769df15e0c97e8d2145d2d10d
Author: Jonathan Wakely <jwakely@redhat.com>
Date: Mon May 4 21:13:28 2020 +0100
libstdc++: Fix incorrect size calculation in PMR resource (PR 94906)
Calculating the size of a chunk being returned to the upstream allocator
was done with a 32-bit type, so it wrapped if the chunk was 4GB or
larger.
I don't know how to test this without allocating 4GB, so there's no test
in the testsuite. It has been tested manually with allocations sizes and
alignments exceeding 4GB.
PR libstdc++/94906
* src/c++17/memory_resource.cc
(monotonic_buffer_resource::_Chunk::release): Use size_t for shift
operands.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
` (2 preceding siblings ...)
2020-05-04 21:48 ` [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource cvs-commit at gcc dot gnu.org
@ 2020-05-05 16:18 ` redi at gcc dot gnu.org
2020-05-12 8:55 ` cvs-commit at gcc dot gnu.org
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: redi at gcc dot gnu.org @ 2020-05-05 16:18 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|--- |9.4
--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Thanks for the report and identifying the source of the bug.
Fixed on master only for now, but backports will come soon.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
` (3 preceding siblings ...)
2020-05-05 16:18 ` redi at gcc dot gnu.org
@ 2020-05-12 8:55 ` cvs-commit at gcc dot gnu.org
2020-05-12 19:41 ` cvs-commit at gcc dot gnu.org
2020-05-12 19:42 ` redi at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2020-05-12 8:55 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:
https://gcc.gnu.org/g:dc103060c18656affaecfdd57faa4e0237dadcd3
commit r10-8136-gdc103060c18656affaecfdd57faa4e0237dadcd3
Author: Jonathan Wakely <jwakely@redhat.com>
Date: Tue May 12 09:54:44 2020 +0100
libstdc++: Fix incorrect size calculation in PMR resource (PR 94906)
Calculating the size of a chunk being returned to the upstream allocator
was done with a 32-bit type, so it wrapped if the chunk was 4GB or
larger.
I don't know how to test this without allocating 4GB, so there's no test
in the testsuite. It has been tested manually of course.
Backport from mainline
2020-05-04 Jonathan Wakely <jwakely@redhat.com>
PR libstdc++/94906
* src/c++17/memory_resource.cc
(monotonic_buffer_resource::_Chunk::release): Use size_t for shift
operands.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
` (4 preceding siblings ...)
2020-05-12 8:55 ` cvs-commit at gcc dot gnu.org
@ 2020-05-12 19:41 ` cvs-commit at gcc dot gnu.org
2020-05-12 19:42 ` redi at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2020-05-12 19:41 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:
https://gcc.gnu.org/g:45a6686e76bfcd48f7c72a23d0e15186f76b4bfc
commit r9-8588-g45a6686e76bfcd48f7c72a23d0e15186f76b4bfc
Author: Jonathan Wakely <jwakely@redhat.com>
Date: Tue May 12 09:54:44 2020 +0100
libstdc++: Fix incorrect size calculation in PMR resource (PR 94906)
Calculating the size of a chunk being returned to the upstream allocator
was done with a 32-bit type, so it wrapped if the chunk was 4GB or
larger.
I don't know how to test this without allocating 4GB, so there's no test
in the testsuite. It has been tested manually of course.
Backport from mainline
2020-05-04 Jonathan Wakely <jwakely@redhat.com>
PR libstdc++/94906
* src/c++17/memory_resource.cc
(monotonic_buffer_resource::_Chunk::release): Use size_t for shift
operands.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
` (5 preceding siblings ...)
2020-05-12 19:41 ` cvs-commit at gcc dot gnu.org
@ 2020-05-12 19:42 ` redi at gcc dot gnu.org
6 siblings, 0 replies; 8+ messages in thread
From: redi at gcc dot gnu.org @ 2020-05-12 19:42 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94906
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|ASSIGNED |RESOLVED
--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Fixed for 9.4 and 10.2
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-05-12 19:42 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-01 17:42 [Bug libstdc++/94906] New: memory corruption in std::pmr::memory_buffer_resource arnaud02 at users dot sourceforge.net
2020-05-01 18:19 ` [Bug libstdc++/94906] " redi at gcc dot gnu.org
2020-05-01 18:46 ` pinskia at gcc dot gnu.org
2020-05-04 21:48 ` [Bug libstdc++/94906] memory corruption in std::pmr::monotonic_buffer_resource cvs-commit at gcc dot gnu.org
2020-05-05 16:18 ` redi at gcc dot gnu.org
2020-05-12 8:55 ` cvs-commit at gcc dot gnu.org
2020-05-12 19:41 ` cvs-commit at gcc dot gnu.org
2020-05-12 19:42 ` redi at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).