gnuplot crashes when binary format ignores all data

Bug #369671 reported by Andrey M
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
gnuplot
Unknown
Unknown
gnuplot (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Binary package hint: gnuplot

andrey@freshmeat:~/tmp$ lsb_release -rd
Description: Ubuntu 8.10
Release: 8.10
andrey@freshmeat:~/tmp$ apt-cache policy gnuplot
gnuplot:
  Installed: 4.2.3-1
  Candidate: 4.2.3-1
  Version table:
 *** 4.2.3-1 0
        500 http://us.archive.ubuntu.com intrepid/universe Packages
        100 /var/lib/dpkg/status
andrey@freshmeat:~/tmp$ g++ tstdat.cpp; ./a.out; gnuplot
gnuplot> plot 'tst.dat' binary format='%*double%*double" using 1:2
*** buffer overflow detected ***: gnuplot terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb792a6d8]
/lib/tls/i686/cmov/libc.so.6[0xb7928800]
/lib/tls/i686/cmov/libc.so.6(__fread_chk+0x143)[0xb79290f3]
gnuplot[0x8069550]
gnuplot[0x80a8620]
gnuplot[0x806230f]
gnuplot[0x806297d]
gnuplot[0x80a4255]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb7846685]
gnuplot[0x80582b1]
======= Memory map: ========
08048000-08168000 r-xp 00000000 08:01 1229602 /usr/bin/gnuplot
08168000-08169000 r--p 0011f000 08:01 1229602 /usr/bin/gnuplot
08169000-0817a000 rw-p 00120000 08:01 1229602 /usr/bin/gnuplot
0817a000-08185000 rw-p 0817a000 00:00 0
09f0d000-0a0ff000 rw-p 09f0d000 00:00 0 [heap]
b6031000-b623e000 rw-p b6031000 00:00 0
b623e000-b62d3000 r--p 00000000 08:01 270337 /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
b62d3000-b6333000 rw-s 00000000 00:09 3866644 /SYSV00000000 (deleted)
b6333000-b6334000 ---p b6333000 00:00 0
b6334000-b6b34000 rw-p b6334000 00:00 0
b6b34000-b6b94000 rw-s 00000000 00:09 3833875 /SYSV00000000 (deleted)
b6b94000-b6b9a000 r-xp 00000000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9a000-b6b9b000 r--p 00005000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9b000-b6b9c000 rw-p 00006000 08:01 1232213 /usr/lib/libgailutil.so.18.0.1
b6b9c000-b6bcb000 r-xp 00000000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcb000-b6bcc000 r--p 0002e000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcc000-b6bcd000 rw-p 0002f000 08:01 1230649 /usr/lib/libgnomecanvas-2.so.0.2001.0
b6bcd000-b6c0b000 r-xp 00000000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0b000-b6c0c000 r--p 0003d000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0c000-b6c0d000 rw-p 0003e000 08:01 499875 /usr/lib/libgnomeprintui-2-2.so.0.1.0
b6c0d000-b6d42000 r-xp 00000000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d42000-b6d43000 ---p 00135000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d43000-b6d47000 r--p 00135000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d47000-b6d48000 rw-p 00139000 08:01 1229934 /usr/lib/libxml2.so.2.6.32
b6d48000-b6d49000 rw-p b6d48000 00:00 0
b6d49000-b6d5e000 r-xp 00000000 08:01 1231100 /usr/lib/libart_lgpl_2.so.2.3.20
b6d5e000-b6d60000 rw-p 00014000 08:01 1231100 /usr/lib/libart_lgpl_2.so.2.3.20
b6d60000-b6dc6000 r-xp 00000000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc6000-b6dc7000 ---p 00066000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc7000-b6dc8000 r--p 00066000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dc8000-b6dc9000 rw-p 00067000 08:01 499867 /usr/lib/libgnomeprint-2-2.so.0.1.0
b6dcb000-b6dcd000 r-xp 00000000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dcd000-b6dce000 r--p 00001000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dce000-b6dcf000 rw-p 00002000 08:01 1411308 /usr/lib/pango/1.6.0/modules/pango-basic-fc.so
b6dcf000-b6dd2000 rw-s 00000000 00:09 3899413 /SYSV00000000 (deleted)
b6dd2000-b6dd8000 r-xp 00000000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dd8000-b6dd9000 r--p 00005000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dd9000-b6dda000 rw-p 00006000 08:01 1253909 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b6dda000-b6de0000 r--s 00000000 08:01 2238113 /var/cache/fontconfig/945677eb7aeaf62f1d50efc3fb3ec7d8-x86.cache-2
b6de0000-b6de3000 r--s 00000000 08:01 2238007 /var/cache/fontconfig/e383d7ea5fbe662a33d9b44caf393297-x86.cache-2
b6de3000-b6de5000 r--s 00000000 08:01 2238067 /var/cache/fontconfig/c69f04ab05004e31a6d5e715764f16d8-x86.cache-2
b6de5000-b6de8000 r--s 00000000 08:01 2238015 /var/cache/fontconfig/6eb3985aa4124903f6ff08ba781cd364-x86.cache-2
b6de8000-b6de9000 r--s 00000000 08:01 2237964 /var/cache/fontconfig/4c73fe0c47614734b17d736dbde7580a-x86.cache-2
b6de9000-b6dec000 r--s 00000000 08:01 2238139 /var/cacAborted

Revision history for this message
Andrey M (andrey.mrt.) wrote :
Andrey M (andrey.mrt.)
description: updated
Revision history for this message
Alex Valavanis (valavanisalex) wrote :

An asterisk in the format string tells gnuplot to ignore a variable. In other words, you're telling it to ignore the entire contents of the datafile and then to plot it. Everything is fine if you use the command:

plot 'tst.dat' binary format '%double' using 1:2

Therefore, the problem occurs when the format string states that all data must be ignored.

Changed in gnuplot (Ubuntu):
status: New → Invalid
Changed in gnuplot (Ubuntu):
status: Invalid → Confirmed
summary: - gnuplot crashes on binary format
+ gnuplot crashes when binary format ignores all data
Revision history for this message
Alex Valavanis (valavanisalex) wrote :

Here's a more complete backtrace for the bug

Revision history for this message
Andrey M (andrey.mrt.) wrote :

The attached file "gdb-chromium-browser.txt" seems irrelevant to this bug.
It is merely a debug dump of chrome, not gnuplot.

Revision history for this message
Alex Valavanis (valavanisalex) wrote :

Oops! Sorry about that. I have now uploaded the correct backtrace file!

Revision history for this message
Ethan Merritt (sfeam) wrote :

I can't reproduce this problem using either the [really old] version 4.2.3 or current 4.4.0
Gnuplot reports an error message about empty data ranges, but recovers gracefully.
Admittedly I'm not running Ubuntu. I tested both 32-bit and 64-bit Mandriva.

Can you get a useful trace of the failure from inside gdb (with line numbers, etc)
or from valgrind?

[19] make tstdat ; ./tstdat ; gnuplot_4.2.3

        G N U P L O T
        Version 4.2 patchlevel 3
        last modified Mar 2008
        System: Linux 2.6.31.12-desktop-3mnb

        Copyright (C) 1986 - 1993, 1998, 2004, 2007, 2008
        Thomas Williams, Colin Kelley and many others

        Type `help` to access the on-line reference manual.
        The gnuplot FAQ is available from http://www.gnuplot.info/faq/

        Send bug reports and suggestions to <http://sourceforge.net/projects/gnuplot>

Terminal type set to 'wxt'
gnuplot> plot 'tst.dat' binary format='%*double%*double" using 1:2
Warning: empty x range [0:0], adjusting to [-1:1]

   sfeam (gnuplot developer)

Revision history for this message
Alex Valavanis (valavanisalex) wrote :

Hi Ethan,

The gdb backtrace I uploaded appears to have line numbers in it. If there's something I did wrong when obtaining the backtrace, please let me know.

I tried running valgrind too. Logfile attached...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.