Skip to content

double free in TNL::Config::ParameterContainer::~ParameterContainer

The implementation of the ParameterContainer class is very poor, because it has an implicit operator= and a data member which involves raw pointers (Containers::List< tnlParameterBase* >), which may lead to double-free.

Test case:

#include <TNL/Devices/Host.h>
#include <TNL/Config/ConfigDescription.h>
#include <TNL/Config/ParameterContainer.h>

using namespace TNL;

int
main( int argc, char* argv[] )
{
   Config::ParameterContainer parameters;
   Config::ConfigDescription conf_desc;

   Devices::Host::configSetup( conf_desc );
   conf_desc.addEntry< String >( "Dummy", "Dummy parameter.", "" );

   if( ! parseCommandLine( argc, argv, conf_desc, parameters ) ) {
      conf_desc.printUsage( argv[ 0 ] );
      return EXIT_FAILURE;
   }


   // create a copy of the parameter container
   Config::ParameterContainer parametersCopy( parameters );

   return EXIT_SUCCESS;
}

Compile and run:

$ clang++ -std=c++11 -O0 -g -I ~/.local/include -L ~/.local/lib -ltnl test_parameter_container.cpp -o test_parameter_container
$ ./test_parameter_container 
double free or corruption (!prev)
Aborted (core dumped)

Backtrace:

(gdb) where
#0  0x00007f58ffc61d7f in raise () from /usr/lib/libc.so.6
#1  0x00007f58ffc4c672 in abort () from /usr/lib/libc.so.6
#2  0x00007f58ffca4878 in __libc_message () from /usr/lib/libc.so.6
#3  0x00007f58ffcab18a in malloc_printerr () from /usr/lib/libc.so.6
#4  0x00007f58ffcacc5c in _int_free () from /usr/lib/libc.so.6
#5  0x00007f5900165862 in TNL::Config::ParameterContainer::~ParameterContainer() ()
   from /home/lahwaacz/.local/lib/libtnl.so.0.1
#6  0x00000000004025db in main (argc=1, argv=0x7fffff0ab188) at test_parameter_container.cpp:26