Out of range vector access in CSlice::intpol

Version v2.4.3b

When compiling with -D_GLIBCXX_ASSERTIONS (default e.g. in RHEL 8), the following assertion can be triggered:

/usr/include/c++/8/bits/stl_vector.h:950: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = double; _Alloc = std::allocator<double>; std::vector<_Tp, _Alloc>::const_reference = const double&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.

Commands to reproduce with these data files:

fl *
0
cc p0*resol(p1)
cv 10
cf

Backtrace:

(gdb) bt
#0  0x00007ffff48c9a9f in raise () from /lib64/libc.so.6
#1  0x00007ffff489ce05 in abort () from /lib64/libc.so.6
#2  0x00007ffff7ac9728 in std::__replacement_assert (__file=__file@entry=0x7ffff7b7f1b8 "/usr/include/c++/8/bits/stl_vector.h", __line=__line@entry=950, 
    __function=__function@entry=0x7ffff7b9e5e0 <_ZZNKSt6vectorIdSaIdEEixEmE19__PRETTY_FUNCTION__> "std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = double; _Alloc = std::allocator<double>; std::vector<_Tp, _Alloc>:"..., 
    __condition=__condition@entry=0x7ffff7b7f188 "__builtin_expect(__n < this->size(), true)") at /usr/include/c++/8/x86_64-redhat-linux/bits/c++config.h:2397
#3  0x00007ffff7b6b2cf in std::vector<double, std::allocator<double> >::operator[] (__n=388, this=0x7fffe7068150) at /usr/include/c++/8/bits/stl_vector.h:948
#4  CSpec::intpol (this=this@entry=0x5555557c2910, xx=std::vector of length 388, capacity 388 = {...}, yy=yy@entry=0x7fffe7068170, dd=dd@entry=0x7fffe7068190) at /Users/spheres/Frida/pub/lib/slice.cpp:161
#5  0x00007ffff7b3b79b in CNodeDirac::convolve (this=<optimized out>, ctx=..., theshift=1, sv=0x5555557c2910, conv_norm=2444.9480890719992, conv_step=<optimized out>) at /Users/spheres/Frida/pub/lib/node.cpp:1498
#6  0x00007ffff7b3a43f in CNodeMixin::tree_val (this=0x5555557b95a0, ctx=...) at /Users/spheres/Frida/pub/lib/node.cpp:1254
#7  0x00007ffff7b3bbab in CNodeFun::tree_val (this=0x5555557b9ed0, ctx=...) at /usr/include/c++/8/bits/shared_ptr_base.h:1018
#8  0x00007ffff7b48128 in COlc::eval_curve_expr (this=0x5555557bb920, vt=std::vector of length 388, capacity 512 = {...}, k=<optimized out>, j=<optimized out>, want_error=<optimized out>) at /usr/include/c++/8/bits/shared_ptr_base.h:1018
#9  0x00007ffff7b4dbe4 in COlc::eval_curve (this=this@entry=0x5555557bb920, vt=std::vector of length 388, capacity 512 = {...}, k=<optimized out>, j=<optimized out>, want_error=want_error@entry=true) at /Users/spheres/Frida/pub/lib/olf.cpp:667
#10 0x00007ffff7b0e3c0 in fit_evaluate (par=<optimized out>, m_dat=<optimized out>, data=0x7fffe7068c40, fvec=0x7fffe0000bd0, userbreak=0x7fffe7068c30) at /Users/spheres/Frida/pub/lib/fit.cpp:257
#11 0x00007ffff557212b in lmmin2 () from /lib64/liblmfit.so.8
#12 0x00007ffff7b0f3cf in NCurveFit::fit_one_spec[abi:cxx11](COlc*, COld const*, int, int, lm_control_struct const&) (fc=0x5555557bb920, fd=<optimized out>, k=<optimized out>, j=<optimized out>, control=...) at /Users/spheres/Frida/pub/lib/fit.cpp:309
#13 0x00007ffff7b0ff86 in NCurveFit::<lambda(int)>::operator() (_jj=<optimized out>, __closure=0x5555557c2e40) at /usr/include/c++/8/bits/stl_vector.h:805
#14 std::_Function_handler<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >(int), NCurveFit::fit(bool)::<lambda(int)> >::_M_invoke(const std::_Any_data &, int &&) (__functor=..., __args#0=<optimized out>) at /usr/include/c++/8/bits/std_function.h:283
#15 0x00007ffff7b0caed in std::function<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (int)>::operator()(int) const (__args#0=<optimized out>, this=0x5555557bfb50) at /usr/include/c++/8/bits/std_function.h:682
#16 threadloop(int, int*, std::function<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > (int)> const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >*, int*, int) (niter=1, jTodo=0x7fffffffd928, exec=..., results=0x7fffffffd940, jReported=0x7fffffffd92c, reportFactor=1) at /Users/spheres/Frida/pub/lib/fit.cpp:49
#17 0x00007ffff529cba3 in execute_native_thread_routine () from /lib64/libstdc++.so.6
#18 0x00007ffff42561cf in start_thread () from /lib64/libpthread.so.0
#19 0x00007ffff48b4dd3 in clone () from /lib64/libc.so.6

Cannot reproduce. Compiled from scratch with cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_FLAGS="-D_GLIBCXX_ASSERTIONS=ON". Executed from gdb. No error, no warning from Frida command cf.

Debian/bookworm, gcc 12.2.0.

Well, reproducing the assertion isn't necessary anyway.

I just checked and the problem is indeed in line 161 of slice.cpp: the loop checks xx[ii] < x[n - 1] but in the last iteration ii is equal to nn (the length of xx), so the access is out of range.

Problem is that the loop breaks if ii >= nn but then increments ii.

mentioned in commit 2a0603f8

mentioned in merge request !7 (merged)

mentioned in commit 7ad1589e

closed with merge request !7 (merged)