Infinite loop of malloc Double

On 22-Apr-2005, Hamish Allan <hamish.allan@xxxxxxxxxx> wrote:

| Bug report for Octave 2.1.64 configured for powerpc-apple-darwin
| 
| Description:
| -----------
| 
| It's about as simple as they come. The first gplot command works fine, 
| the same gplot command through exec causes the infinite loop of death.
| 
| 
| Welcome to Darwin!
| taos:~ hamish$ octave
| GNU Octave, version 2.1.64 (powerpc-apple-darwin).
| Copyright (C) 2004 John W. Eaton.
| This is free software; see the source code for copying conditions.
| There is ABSOLUTELY NO WARRANTY; not even for MERCHANTIBILITY or
| FITNESS FOR A PARTICULAR PURPOSE.  For details, type `warranty'.
| 
| Additional information about Octave is available at 
| http://www.octave.org.
| 
| Please contribute if you find this software useful.
| For more information, visit http://www.octave.org/help-wanted.html
| 
| Report bugs to <bug@xxxxxxxxxx> (but first, please read
| http://www.octave.org/bugs.html to learn how to write a helpful report).
| 
| octave:1> gset term aqua
| octave:2> gplot '2*x+1'
| octave:3> exec("gplot '2*x+1'")
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free
| *** malloc[28062]: error for object 0x634b90: Double free

I don't know what you were expecting the exec command to do.  It will
replace the running Octave with the executed external program.  So
unless a command called "gplot" exists somewhere on your system, I
would expect this to return -1.  In any case, this is definitely a bug
(and it's a bit embarrassing and surprising that it has not been
reported until now).  Anyway, please try the following patch.

Thanks,

jwe


liboctave/ChangeLog:

2005-04-25  John W. Eaton  <jwe@xxxxxxxxxx>

        * str-vec.cc (string_vector::delete_c_str_vec): Correctly free
        array and its contents.


Index: liboctave/str-vec.cc
===================================================================
RCS file: /usr/local/cvsroot/octave/liboctave/str-vec.cc,v
retrieving revision 1.16
diff -u -r1.16 str-vec.cc
--- liboctave/str-vec.cc        20 Nov 2003 04:35:55 -0000      1.16
+++ liboctave/str-vec.cc        25 Apr 2005 16:32:16 -0000
@@ -142,8 +142,10 @@
 void
 string_vector::delete_c_str_vec (const char * const *v)
 {
-  while (*v)
-    delete [] *v;
+  const char * const *p = v;
+
+  while (*p)
+    delete [] *p++;
 
   delete [] v;
 }



-------------------------------------------------------------
Octave is freely available under the terms of the GNU GPL.

Octave's home on the web:  http://www.octave.org
How to fund new projects:  http://www.octave.org/funding.html
Subscription information:  http://www.octave.org/archive.html
-------------------------------------------------------------