[Octave-bug-tracker] [bug #65944] octave-dicom: crash in test suite with use-after-free on ubuntu 24.10

[anonymous]

URL:
  <https://savannah.gnu.org/bugs/?65944>

                 Summary: octave-dicom: crash in test suite with
use-after-free on ubuntu 24.10
                   Group: GNU Octave
               Submitter: None
               Submitted: Wed 03 Jul 2024 07:04:29 PM UTC
                Category: Octave Package
                Severity: 3 - Normal
                Priority: 5 - Normal
              Item Group: Segfault, Bus Error, etc.
                  Status: None
             Assigned to: None
         Originator Name: Daniel Bungert
        Originator Email: daniel.bungert@canonical.com
             Open/Closed: Open
                 Release: other
         Discussion Lock: Any
        Operating System: GNU/Linux
           Fixed Release: None
         Planned Release: None


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Wed 03 Jul 2024 07:04:29 PM UTC By: Anonymous
Other bug reference URLs:

https://bugs.launchpad.net/debian/+source/octave-dicom/+bug/2069660
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1075721

Greetings!

Recent attempts to build octave-dicom on Ubuntu 24.10 resulted in test suite
failures, with a use-after-free crash.

Tracing with valgrind shows that the std::map destructors are performing an
overwriting clear operation during cleanup, but I don't think this is a
std::map bug.

dicomdict uses std::map and contains them globally in non-static storage. 
Also, dicomdict.o is built into multiple .oct files provided by octave-dicom
and I believe this is what causes the problem - at cleanup time, the
duplicated RTLD_GLOBAL symbols may not be being run in the correct fashion.

For Ubuntu I have modified octave-dicom as such (also attached):

--- a/src/dicomdict.cpp
+++ b/src/dicomdict.cpp
@@ -51,9 +51,9 @@
 const char * factory_dicom_dict_filename="octavedicom.dic";
 static std::string dic_filename(factory_dicom_dict_filename);
 
-std::map<gdcm::Tag, std::string> tagmap ;
-std::map<std::string, gdcm::Tag> keymap ;
-std::map<std::string, gdcm::DictEntry> dict ;
+static std::map<gdcm::Tag, std::string> tagmap ;
+static std::map<std::string, gdcm::Tag> keymap ;
+static std::map<std::string, gdcm::DictEntry> dict ;
 
 void insert(const char *k, const gdcm::Tag t, const gdcm::DictEntry e)
 {


With this modification the test suite passes.  I also played with
dicomdict/other plugins to see if they behave correctly and everyone seems
fine with the modification in my scenarios (load dicomdict before or after
other plugins that use dicomdict).

Another option I explored was to no longer build dicomdict.o into the relevant
*.oct files, but I don't know much about Octave and it's not clear to me if
some sort of plugin ordering can be enforced to ensure that dicomdict is
loaded before the others that require it.

I expect that this is not limited to a test suite problem and may similarly
cause programs that use octave-dicom to crash on exit.






    _______________________________________________________
File Attachments:


-------------------------------------------------------
Name: dicomdict-use-after-free.patch  Size: 970B
<https://file.savannah.gnu.org/file/dicomdict-use-after-free.patch?file_id=56221>

    AGPL NOTICE

These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://git.savannah.nongnu.org/cgit/administration/savane.git/snapshot/savane-05dcad1214d86f0cdb09953df600b098f3426851.tar.gz

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?65944>

_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/

signature.asc
Description: PGP signature