gnuplot crashes when binary format ignores all data

[Andrey M]

Binary package hint: gnuplot

andrey@freshmeat:~/tmp$ lsb_release -rd
Description: Ubuntu 8.10
Release: 8.10
andrey@freshmeat:~/tmp$ apt-cache policy gnuplot
gnuplot:
  Installed: 4.2.3-1
  Candidate: 4.2.3-1
  Version table:
 *** 4.2.3-1 0
        500 http://us.archive.ubuntu.com intrepid/universe Packages
        100 /var/lib/dpkg/status
andrey@freshmeat:~/tmp$ g++ tstdat.cpp; ./a.out; gnuplot
gnuplot> plot 'tst.dat' binary format='%*double%*double" using 1:2
*** buffer overflow detected ***: gnuplot terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb792a6d8]
/lib/tls/i686/cmov/libc.so.6[0xb7928800]
/lib/tls/i686/cmov/libc.so.6(__fread_chk+0x143)[0xb79290f3]
gnuplot[0x8069550]
gnuplot[0x80a8620]
gnuplot[0x806230f]
gnuplot[0x806297d]
gnuplot[0x80a4255]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb7846685]
gnuplot[0x80582b1]
======= Memory map: ========
08048000-08168000 r-xp 00000000 08:01 1229602 /usr/bin/gnuplot
08168000-08169000 r--p 0011f000 08:01 1229602 /usr/bin/gnuplot
08169000-0817a000 rw-p 00120000 08:01 1229602 /usr/bin/gnuplot
0817a000-08185000 rw-p 0817a000 00:00 0
09f0d000-0a0ff000 rw-p 09f0d000 00:00 0 [heap]
b6031000-b623e000 rw-p b6031000 00:00 0
b623e000-b62d3000 r--p 00000000 08:01 270337 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
b62d3000-b6333000 rw-s 00000000 00:09 3866644 /SYSV00000000 (deleted)
b6333000-b6334000 ---p b6333000 00:00 0
b6334000-b6b34000 rw-p b6334000 00:00 0
b6b34000-b6b94000 rw-s 00000000 00:09 3833875 /SYSV00000000 (deleted)
b6b94000-b6b9a000 r-xp 00000000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9a000-b6b9b000 r--p 00005000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9b000-b6b9c000 rw-p 00006000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9c000-b6bcb000 r-xp 00000000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcb000-b6bcc000 r--p 0002e000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcc000-b6bcd000 rw-p 0002f000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcd000-b6c0b000 r-xp 00000000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0b000-b6c0c000 r--p 0003d000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0c000-b6c0d000 rw-p 0003e000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0d000-b6d42000 r-xp 00000000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d42000-b6d43000 ---p 00135000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d43000-b6d47000 r--p 00135000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d47000-b6d48000 rw-p 00139000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d48000-b6d49000 rw-p b6d48000 00:00 0
b6d49000-b6d5e000 r-xp 00000000 08:01 1231100 /usr/lib/libart_lgpl_2.so.2.3.20
b6d5e000-b6d60000 rw-p 00014000 08:01 1231100 /usr/lib/libart_lgpl_2.so.2.3.20
b6d60000-b6dc6000 r-xp 00000000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc6000-b6dc7000 ---p 00066000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc7000-b6dc8000 r--p 00066000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc8000-b6dc9000 rw-p 00067000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dcb000-b6dcd000 r-xp 00000000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dcd000-b6dce000 r--p 00001000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dce000-b6dcf000 rw-p 00002000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dcf000-b6dd2000 rw-s 00000000 00:09 3899413 /SYSV00000000 (deleted)
b6dd2000-b6dd8000 r-xp 00000000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dd8000-b6dd9000 r--p 00005000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dd9000-b6dda000 rw-p 00006000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dda000-b6de0000 r--s 00000000 08:01 2238113 /var/cache/fontconfig/945677eb7aeaf62f1d50efc3fb3ec7d8-x86.cache-2
b6de0000-b6de3000 r--s 00000000 08:01 2238007 /var/cache/fontconfig/e383d7ea5fbe662a33d9b44caf393297-x86.cache-2
b6de3000-b6de5000 r--s 00000000 08:01 2238067 /var/cache/fontconfig/c69f04ab05004e31a6d5e715764f16d8-x86.cache-2
b6de5000-b6de8000 r--s 00000000 08:01 2238015 /var/cache/fontconfig/6eb3985aa4124903f6ff08ba781cd364-x86.cache-2
b6de8000-b6de9000 r--s 00000000 08:01 2237964 /var/cache/fontconfig/4c73fe0c47614734b17d736dbde7580a-x86.cache-2
b6de9000-b6dec000 r--s 00000000 08:01 2238139 /var/cacAborted

[Alex Valavanis (valavanisalex)]

An asterisk in the format string tells gnuplot to ignore a variable. In other words, you're telling it to ignore the entire contents of the datafile and then to plot it. Everything is fine if you use the command:

plot 'tst.dat' binary format '%double' using 1:2

Therefore, the problem occurs when the format string states that all data must be ignored.

[Alex Valavanis (valavanisalex)]

Here's a more complete backtrace for the bug

[Andrey M (andrey.mrt.)]

The attached file "gdb-chromium-browser.txt" seems irrelevant to this bug.
It is merely a debug dump of chrome, not gnuplot.

[Alex Valavanis (valavanisalex)]

Oops! Sorry about that. I have now uploaded the correct backtrace file!

[Ethan Merritt (sfeam)]

I can't reproduce this problem using either the [really old] version 4.2.3 or current 4.4.0
Gnuplot reports an error message about empty data ranges, but recovers gracefully.
Admittedly I'm not running Ubuntu. I tested both 32-bit and 64-bit Mandriva.

Can you get a useful trace of the failure from inside gdb (with line numbers, etc)
or from valgrind?

[19] make tstdat ; ./tstdat ; gnuplot_4.2.3

        G N U P L O T
        Version 4.2 patchlevel 3
        last modified Mar 2008
        System: Linux 2.6.31.12-desktop-3mnb

        Copyright (C) 1986 - 1993, 1998, 2004, 2007, 2008
        Thomas Williams, Colin Kelley and many others

        Type `help` to access the on-line reference manual.
        The gnuplot FAQ is available from http://www.gnuplot.info/faq/

        Send bug reports and suggestions to <http://sourceforge.net/projects/gnuplot>

Terminal type set to 'wxt'
gnuplot> plot 'tst.dat' binary format='%*double%*double" using 1:2
Warning: empty x range [0:0], adjusting to [-1:1]

   sfeam (gnuplot developer)

[Alex Valavanis (valavanisalex)]

Hi Ethan,

The gdb backtrace I uploaded appears to have line numbers in it. If there's something I did wrong when obtaining the backtrace, please let me know.

I tried running valgrind too. Logfile attached...