| Subject: | cleardb() double-free segv |
cleardb() in Image-Seek-0.01 segfaults if called more than once after an
image has been added. The sigStruct members of sigMap sigs aren't being
deleted.
To reproduce, make an in-memory database containing one or more image
sigs and try to cleardb() it twice:
# Minimum steps to reproduce
$img = Imager->new(xsize => 1, ysize => 1);
Image::Seek::add_image($img, 1);
Image::Seek::cleardb(); # succeeds
Image::Seek::cleardb(); # fails
The attached patchfile fixes this, and adds a regression test case. If
the test case is run against an otherwise unmodified Image::Seek 0.01
from CPAN, the following happens on my machine:
$ make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/Image-Seek.......ok
t/regr2xfree001....ok 3/4*** glibc detected *** double free or
corruption (out): 0x081ded18 ***
t/regr2xfree001....dubious
Test returned status 0 (wstat 6, 0x6)
DIED. FAILED test 4
Failed 1/4 tests, 75.00% okay
Failed Test Stat Wstat Total Fail Failed List of Failed
------------------------------------------------------------------\\
t/regr2xfree001.t 0 6 4 2 50.00% 4
Failed 1/2 test scripts, 50.00% okay. 1/5 subtests failed, 80.00% okay.
make: *** [test_dynamic] Error 255
Reproducible in Debian iX86 unstable/testing, Ubuntu iX86 dapper, and
Debian amd64 testing.
| Subject: | Image-Seek-0.01andrewc1.diff |
diff -NrU2 Image-Seek-0.01/imgdb.cpp Image-Seek-0.01andrewc1/imgdb.cpp
--- Image-Seek-0.01/imgdb.cpp 2006-01-21 17:12:19.000000000 +0000
+++ Image-Seek-0.01andrewc1/imgdb.cpp 2006-08-24 13:02:17.000000000 +0100
@@ -48,4 +48,5 @@
delete (*it).second;
}
+ sigs.clear();
for (int c = 0;c<3;c++) for (int pn=0;pn<2;pn++)
for (int i = 0;i<16384;i++) {
diff -NrU2 Image-Seek-0.01/MANIFEST Image-Seek-0.01andrewc1/MANIFEST
--- Image-Seek-0.01/MANIFEST 2006-01-21 16:56:36.000000000 +0000
+++ Image-Seek-0.01andrewc1/MANIFEST 2006-08-24 13:02:45.000000000 +0100
@@ -14,2 +14,3 @@
imgdb.cpp
imgdb.h
+t/regr2xfree001.t
diff -NrU2 Image-Seek-0.01/t/regr2xfree001.t Image-Seek-0.01andrewc1/t/regr2xfree001.t
--- Image-Seek-0.01/t/regr2xfree001.t 1970-01-01 01:00:00.000000000 +0100
+++ Image-Seek-0.01andrewc1/t/regr2xfree001.t 2006-08-24 13:01:18.000000000 +0100
@@ -0,0 +1,19 @@
+#!/usr/bin/perl
+
+use Test;
+BEGIN { plan tests => 4 };
+use Image::Seek;
+use Imager;
+
+# test we're not regressing against a double-free bug in I::S 0.01
+Image::Seek::cleardb();
+ok(1);
+Image::Seek::cleardb();
+ok(1);
+$img = Imager->new(xsize => 1, ysize => 1);
+Image::Seek::add_image($img, 1);
+Image::Seek::cleardb();
+ok(1);
+Image::Seek::cleardb();
+ok(1);
+