[ruby-dev:25157] Re: double free problem

In article <[e-mail]>,
  Yukihiro Matsumoto <[e-mail]> writes:

> |　最近の ruby 1.8 で、以下のようなスクリプトで double free が起きて
> |います。プラットフォームは FreeBSD 4.10-STABLE 及び 5.3-STABLE です。
> |1.8.2-preview2 までは発生せず、間はわかりませんが 1.8.2-preview3
> |以降は発生しています。
>
> ふうむ。linux + valgrind では発見できませんでした。
> どなたか再現情報をお持ちの方はいらっしゃいませんでしょうか。

なんとなく boron で試した所、Invalid free() が出て来ましたが、これは違
うんでしょうか。

Z:akr@boron% cat z.rb 
require 'dl/import'

module LIBC
  PATH_MAX = 1024

  extend DL::Importable
  dlload "libc.so.6"
  extern "char *realpath(char *, char *)"
end

def File.realpath(path)
  return LIBC.realpath(path[0...(LIBC::PATH_MAX - 1)],
                       "\0" * LIBC::PATH_MAX) || File.expand_path(path)
end

p File.realpath("/home/akr")
Z:akr@boron% valgrind ruby -v z.rb
==31994== Memcheck, a memory error detector for x86-linux.
==31994== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al.
==31994== Using valgrind-2.2.0, a program supervision framework for x86-linux.
==31994== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al.
==31994== For more details, rerun with: -v
==31994== 
ruby 1.9.0 (2004-12-11) [i686-linux]
==31994== Invalid read of size 1
==31994==    at 0x1B904788: strlen (mac_replace_strmem.c:189)
==31994==    by 0x80B59F7: rb_str_new2 (string.c:115)
==31994==    by 0x80B5A90: rb_tainted_str_new2 (string.c:133)
==31994==    by 0x1BBA7116: rb_dlsym_call (sym.c:919)
==31994==  Address 0x1BB7AC80 is 0 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904791: strlen (mac_replace_strmem.c:189)
==31994==    by 0x80B59F7: rb_str_new2 (string.c:115)
==31994==    by 0x80B5A90: rb_tainted_str_new2 (string.c:133)
==31994==    by 0x1BBA7116: rb_dlsym_call (sym.c:919)
==31994==  Address 0x1BB7AC81 is 1 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904AE0: memcpy (mac_replace_strmem.c:285)
==31994==    by 0x80B597D: str_new (string.c:94)
==31994==    by 0x80B59D0: rb_str_new (string.c:105)
==31994==    by 0x80B5A03: rb_str_new2 (string.c:115)
==31994==  Address 0x1BB7AC88 is 8 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904AEA: memcpy (mac_replace_strmem.c:286)
==31994==    by 0x80B597D: str_new (string.c:94)
==31994==    by 0x80B59D0: rb_str_new (string.c:105)
==31994==    by 0x80B5A03: rb_str_new2 (string.c:115)
==31994==  Address 0x1BB7AC87 is 7 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904AF1: memcpy (mac_replace_strmem.c:287)
==31994==    by 0x80B597D: str_new (string.c:94)
==31994==    by 0x80B59D0: rb_str_new (string.c:105)
==31994==    by 0x80B5A03: rb_str_new2 (string.c:115)
==31994==  Address 0x1BB7AC86 is 6 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904AF8: memcpy (mac_replace_strmem.c:288)
==31994==    by 0x80B597D: str_new (string.c:94)
==31994==    by 0x80B59D0: rb_str_new (string.c:105)
==31994==    by 0x80B5A03: rb_str_new2 (string.c:115)
==31994==  Address 0x1BB7AC85 is 5 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid read of size 1
==31994==    at 0x1B904B10: memcpy (mac_replace_strmem.c:292)
==31994==    by 0x80B597D: str_new (string.c:94)
==31994==    by 0x80B59D0: rb_str_new (string.c:105)
==31994==    by 0x80B5A03: rb_str_new2 (string.c:115)
==31994==  Address 0x1BB7AC80 is 0 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
==31994== 
==31994== Invalid free() / delete / delete[]
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7133: rb_dlsym_call (sym.c:923)
==31994==  Address 0x1BB7AC80 is 0 bytes inside a block of size 1025 free'd
==31994==    at 0x1B905460: free (vg_replace_malloc.c:153)
==31994==    by 0x8070555: ruby_xfree (gc.c:179)
==31994==    by 0x1BBA1CDE: dlfree (dl.c:143)
==31994==    by 0x1BBA7286: rb_dlsym_call (sym.c:879)
"/home/akr"
==31994== 
==31994== ERROR SUMMARY: 20 errors from 8 contexts (suppressed: 20 from 2)
==31994== malloc/free: in use at exit: 425848 bytes in 8970 blocks.
==31994== malloc/free: 9602 allocs, 633 frees, 481163 bytes allocated.
==31994== For a detailed leak analysis,  rerun with: --leak-check=yes
==31994== For counts of detected errors, rerun with: -v
Z:akr@boron% 
-- 
[田中 哲][たなか あきら][Tanaka Akira]