coin-or / coin-or/Cbc

free() invalid pointer

Open
#367 14 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1k
Forks
144
PR merge metrics
No merged PRs in 30d

Description

Hello,

When using cbc through it's rust binding, and trying to solve the very simple unbounded problem that follows, cbc tries to free invalid memory (`free(): invalid pointer`).

The problem is defined in rust with

```rust
let mut m = Model::default();
let z = m.add_col();
m.set_obj_coeff(z, 1.);
m.set_col_lower(z, -1e100);
m.set_obj_sense(Sense::Minimize);
m.solve();
```

Stack trace :

![image](https://user-images.githubusercontent.com/552629/109989579-ea5b6280-7d08-11eb-936d-af88708eb624.png)

```
Thread 15 "test::unbounded" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffff4eb0640 (LWP 83151)]
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
49 ../sysdeps/unix/sysv/linux/raise.c: Aucun fichier ou dossier de ce type.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1 0x00007ffff7b4a864 in __GI_abort () at abort.c:79
#2 0x00007ffff7badaf6 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7cd5128 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007ffff7bb646c in malloc_printerr (str=str@entry=0x7ffff7cd330f "free(): invalid pointer") at malloc.c:5389
#4 0x00007ffff7bb7e84 in _int_free (av=, p=, have_lock=0) at malloc.c:4201
#5 0x00007ffff7870bb8 in ClpModel::gutsOfDelete(int) () from /usr/lib/x86_64-linux-gnu/libClp.so.1
#6 0x00007ffff787ac9b in ClpModel::~ClpModel() () from /usr/lib/x86_64-linux-gnu/libClp.so.1
#7 0x00007ffff79e6a35 in OsiClpSolverInterface::~OsiClpSolverInterface() () from /usr/lib/x86_64-linux-gnu/libOsiClp.so.1
#8 0x00007ffff79e6c9d in OsiClpSolverInterface::~OsiClpSolverInterface() () from /usr/lib/x86_64-linux-gnu/libOsiClp.so.1
#9 0x00007ffff75b2de2 in CbcModel::~CbcModel() () from /usr/lib/x86_64-linux-gnu/libCbc.so.3
#10 0x00007ffff75b2dfd in CbcModel::~CbcModel() () from /usr/lib/x86_64-linux-gnu/libCbc.so.3
#11 0x00007ffff7ede924 in Cbc_deleteModel () from /usr/lib/x86_64-linux-gnu/libCbcSolver.so.3
#12 0x00005555555945de in ::drop (self=0x7ffff4eaf5a8) at /home/ophir/Developpement/coin_cbc/src/raw.rs:390
#13 0x000055555559302e in core::ptr::drop_in_place () at /home/ophir/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:179
#14 0x000055555559227e in core::ptr::drop_in_place () at /home/ophir/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:179
#15 0x00005555555a94d1 in coin_cbc::test::unbounded () at /home/ophir/Developpement/coin_cbc/src/lib.rs:408
#16 0x000055555558995a in coin_cbc::test::unbounded::{{closure}} () at /home/ophir/Developpement/coin_cbc/src/lib.rs:401
```

Initially reported in https://github.com/KardinalAI/coin_cbc/issues/9

Using libcbc `2.10.5+ds1-1 amd64` (from the ubuntu repository), with ubuntu 20.10.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with the Rust `test::unbounded` case in `src/lib.rs` around lines 401-408, then inspect the model drop path in `src/raw.rs:390` and the `Cbc_deleteModel` call shown in the stack trace. Trace the Cbc and Clp destruction sequence to identify why this case reaches `free(): invalid pointer`; done means the example completes without an invalid free.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, rust
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.