double free in TNL::Config::ParameterContainer::~ParameterContainer
The implementation of the ParameterContainer class is very poor, because it has an implicit operator=
and a data member which involves raw pointers (Containers::List< tnlParameterBase* >
), which may lead to double-free.
Test case:
#include <TNL/Devices/Host.h>
#include <TNL/Config/ConfigDescription.h>
#include <TNL/Config/ParameterContainer.h>
using namespace TNL;
int
main( int argc, char* argv[] )
{
Config::ParameterContainer parameters;
Config::ConfigDescription conf_desc;
Devices::Host::configSetup( conf_desc );
conf_desc.addEntry< String >( "Dummy", "Dummy parameter.", "" );
if( ! parseCommandLine( argc, argv, conf_desc, parameters ) ) {
conf_desc.printUsage( argv[ 0 ] );
return EXIT_FAILURE;
}
// create a copy of the parameter container
Config::ParameterContainer parametersCopy( parameters );
return EXIT_SUCCESS;
}
Compile and run:
$ clang++ -std=c++11 -O0 -g -I ~/.local/include -L ~/.local/lib -ltnl test_parameter_container.cpp -o test_parameter_container
$ ./test_parameter_container
double free or corruption (!prev)
Aborted (core dumped)
Backtrace:
(gdb) where
#0 0x00007f58ffc61d7f in raise () from /usr/lib/libc.so.6
#1 0x00007f58ffc4c672 in abort () from /usr/lib/libc.so.6
#2 0x00007f58ffca4878 in __libc_message () from /usr/lib/libc.so.6
#3 0x00007f58ffcab18a in malloc_printerr () from /usr/lib/libc.so.6
#4 0x00007f58ffcacc5c in _int_free () from /usr/lib/libc.so.6
#5 0x00007f5900165862 in TNL::Config::ParameterContainer::~ParameterContainer() ()
from /home/lahwaacz/.local/lib/libtnl.so.0.1
#6 0x00000000004025db in main (argc=1, argv=0x7fffff0ab188) at test_parameter_container.cpp:26