free() invalid pointer
- Dominant language
- C++
- Stars
- 1k
- Forks
- 144
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
When using cbc through it's rust binding, and trying to solve the very simple unbounded problem that follows, cbc tries to free invalid memory (`free(): invalid pointer`).
The problem is defined in rust with
```rust
let mut m = Model::default();
let z = m.add_col();
m.set_obj_coeff(z, 1.);
m.set_col_lower(z, -1e100);
m.set_obj_sense(Sense::Minimize);
m.solve();
```
Stack trace :

```
Thread 15 "test::unbounded" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff4eb0640 (LWP 83151)]
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
49 ../sysdeps/unix/sysv/linux/raise.c: Aucun fichier ou dossier de ce type.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1 0x00007ffff7b4a864 in __GI_abort () at abort.c:79
#2 0x00007ffff7badaf6 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7cd5128 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007ffff7bb646c in malloc_printerr (str=str@entry=0x7ffff7cd330f "free(): invalid pointer") at malloc.c:5389
#4 0x00007ffff7bb7e84 in _int_free (av=, p=, have_lock=0) at malloc.c:4201
#5 0x00007ffff7870bb8 in ClpModel::gutsOfDelete(int) () from /usr/lib/x86_64-linux-gnu/libClp.so.1
#6 0x00007ffff787ac9b in ClpModel::~ClpModel() () from /usr/lib/x86_64-linux-gnu/libClp.so.1
#7 0x00007ffff79e6a35 in OsiClpSolverInterface::~OsiClpSolverInterface() () from /usr/lib/x86_64-linux-gnu/libOsiClp.so.1
#8 0x00007ffff79e6c9d in OsiClpSolverInterface::~OsiClpSolverInterface() () from /usr/lib/x86_64-linux-gnu/libOsiClp.so.1
#9 0x00007ffff75b2de2 in CbcModel::~CbcModel() () from /usr/lib/x86_64-linux-gnu/libCbc.so.3
#10 0x00007ffff75b2dfd in CbcModel::~CbcModel() () from /usr/lib/x86_64-linux-gnu/libCbc.so.3
#11 0x00007ffff7ede924 in Cbc_deleteModel () from /usr/lib/x86_64-linux-gnu/libCbcSolver.so.3
#12 0x00005555555945de in ::drop (self=0x7ffff4eaf5a8) at /home/ophir/Developpement/coin_cbc/src/raw.rs:390
#13 0x000055555559302e in core::ptr::drop_in_place () at /home/ophir/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:179
#14 0x000055555559227e in core::ptr::drop_in_place () at /home/ophir/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:179
#15 0x00005555555a94d1 in coin_cbc::test::unbounded () at /home/ophir/Developpement/coin_cbc/src/lib.rs:408
#16 0x000055555558995a in coin_cbc::test::unbounded::{{closure}} () at /home/ophir/Developpement/coin_cbc/src/lib.rs:401
```
Initially reported in https://github.com/KardinalAI/coin_cbc/issues/9
Using libcbc `2.10.5+ds1-1 amd64` (from the ubuntu repository), with ubuntu 20.10.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the failure with the Rust `test::unbounded` case in `src/lib.rs` around lines 401-408, then inspect the model drop path in `src/raw.rs:390` and the `Cbc_deleteModel` call shown in the stack trace. Trace the Cbc and Clp destruction sequence to identify why this case reaches `free(): invalid pointer`; done means the example completes without an invalid free.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, rust
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100