[Octave-bug-tracker] [bug #53644] Possible Octave or Nouveau image plot bug (not sure which) discovered via ASAN

[Dan Sebald]

URL:
  <http://savannah.gnu.org/bugs/?53644>

                 Summary: Possible Octave or Nouveau image plot bug (not sure
which) discovered via ASAN
                 Project: GNU Octave
            Submitted by: sebald
            Submitted on: Fri 13 Apr 2018 06:28:23 PM UTC
                Category: Plotting with OpenGL
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: None
                  Status: None
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
                 Release: dev
        Operating System: GNU/Linux

    _______________________________________________________

Details:

In Bug #53604 I've scene an ancillary issue with some OpenGL image plotting:


octave:1> demo image
image example 1:
 clf;
 colormap (jet (21));
 img = 1 ./ hilb (11);
 x = y = -5:5;
 subplot (2,2,1);
  h = image (x, y, img);
  ylabel ("limits = [-5.5, 5.5]");
  title ("image (x, y, img)");
 subplot (2,2,2);
  h = image (-x, y, img);
  title ("image (-x, y, img)");
 subplot (2,2,3);
  h = image (x, -y, img);
  title ("image (x, -y, img)");
  ylabel ("limits = [-5.5, 5.5]");
 subplot (2,2,4);
  h = image (-x, -y, img);
  title ("image (-x, -y, img)");

octave:2> =================================================================
==3309==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x611000d406a8 at pc 0x7f656654a733 bp 0x7fff060b1cc0 sp 0x7fff060b1468
READ of size 200 at 0x611000d406a8 thread T0
    #0 0x7f656654a732  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
    #1 0x7f65226a8dbc 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bddbc)
    #2 0x7f65226a9cfb 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5becfb)
    #3 0x7f65226a9e76 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bee76)
    #4 0x7f65226b49fd 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5c99fd)
    #5 0x7f652234782e 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x25c82e)
    #6 0x7f652230c9d5 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x2219d5)
    #7 0x7f65222f0ddb 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x205ddb)
    #8 0x7f65223097a2 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x21e7a2)
    #9 0x7f65221b9234  (/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0xce234)
    #10 0x7f6564747feb in octave::opengl_renderer::set_polygon_offset(bool,
float) ../octave/libinterp/corefcn/gl-render.cc:3932
    #11 0x7f656474fde8 in
octave::opengl_renderer::draw_axes_planes(axes::properties const&)
../octave/libinterp/corefcn/gl-render.cc:1194
    #12 0x7f6564791374 in octave::opengl_renderer::draw_axes(axes::properties
const&) ../octave/libinterp/corefcn/gl-render.cc:2125
    #13 0x7f656474afdd in octave::opengl_renderer::draw(graphics_object
const&, bool) ../octave/libinterp/corefcn/gl-render.cc:647
    #14 0x7f65660c3a15 in octave::opengl_renderer::draw(Matrix const&, bool)
../octave/libinterp/corefcn/gl-render.h:60
    #15 0x7f656475e6bc in
octave::opengl_renderer::draw_figure(figure::properties const&)
../octave/libinterp/corefcn/gl-render.cc:712
    #16 0x7f656474afdd in octave::opengl_renderer::draw(graphics_object
const&, bool) ../octave/libinterp/corefcn/gl-render.cc:647
    #17 0x7f656601904a in QtHandles::GLCanvas::draw(octave_handle const&)
../octave/libgui/graphics/GLCanvas.cc:72
    #18 0x7f6565fcbdfb in QtHandles::Canvas::canvasPaintEvent()
../octave/libgui/graphics/Canvas.cc:304
    #19 0x7f655d53686c 
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1b386c)
    #20 0x7f655d516047 in QWidget::event(QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x193047)
    #21 0x7f655d4d782b in QApplicationPrivate::notify_helper(QObject*,
QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #22 0x7f655d4df0f3 in QApplication::notify(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #23 0x7f655c7595c7 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a5c7)
    #24 0x7f655d50f189 in QWidgetPrivate::sendPaintEvent(QRegion const&)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x18c189)
    #25 0x7f655d4e6703 
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x163703)
    #26 0x7f655d4e7094 
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x164094)
    #27 0x7f655d4fe66e in QWidgetPrivate::syncBackingStore()
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x17b66e)
    #28 0x7f655d5161b7 in QWidget::event(QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1931b7)
    #29 0x7f655d629b6a in QMainWindow::event(QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2a6b6a)
    #30 0x7f6565f63124 in QtHandles::FigureWindowBase::event(QEvent*)
../octave/libgui/graphics/FigureWindow.h:33
    #31 0x7f655d4d782b in QApplicationPrivate::notify_helper(QObject*,
QEvent*) (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15482b)
    #32 0x7f655d4df0f3 in QApplication::notify(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x15c0f3)
    #33 0x7f655c7595c7 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28a5c7)
    #34 0x7f655c75bd3c in QCoreApplicationPrivate::sendPostedEvents(QObject*,
int, QThreadData*) (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x28cd3c)
    #35 0x7f655c7b2eb2  (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e3eb2)
    #36 0x7f65541b2286 in g_main_context_dispatch
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c286)
    #37 0x7f65541b24bf  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c4bf)
    #38 0x7f65541b254b in g_main_context_iteration
(/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c54b)
    #39 0x7f655c7b24de in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2e34de)
    #40 0x7f655c757619 in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x288619)
    #41 0x7f655c760663 in QCoreApplication::exec()
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x291663)
    #42 0x7f6565dab253 in octave::gui_application::execute()
../octave/libgui/src/octave-gui.cc:202
    #43 0x562a27d7afa9 in main ../octave/src/main-gui.cc:104
    #44 0x7f655ee21b96 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #45 0x562a27d7b849 in _start
(/home/sebald/octave/octave-53604/build1/src/.libs/octave-gui+0x2849)

0x611000d406a8 is located 0 bytes to the right of 232-byte region
[0x611000d405c0,0x611000d406a8)
allocated by thread T0 here:
    #0 0x7f65665afd38 in __interceptor_calloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded38)
    #1 0x7f65226a6032 
(/usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so+0x5bb032)

SUMMARY: AddressSanitizer: heap-buffer-overflow
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732) 
Shadow bytes around the buggy address:
  0x0c22801a0080: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c22801a00a0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c22801a00b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c22801a00c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c22801a00d0: 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa
  0x0c22801a00e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a00f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c22801a0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3309==ABORTING


>From my recollection reading other bugs in the track, Nouveau is known to have
some issues.  It's only on some KDE test platforms that Nouveau is run,
whereas on my Mint/Cinnamon system the Nvidia driver is used.  It could be
that Nvidia driver is more forgiving, if there happened to be an Octave bug in
using OpenGL, but I'm not sure what the issue is.




    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?53644>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/