-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Copying a FFN leads to silently corrupted memory (address sanitizer detects a heap use after free) #2314
Description
Issue description
Unfortunately, when copying a mlpack::ann::FFN, the program seems to continue operating normally, but in a program with longer runtime and dynamic memory usage, bizarre effects can surface hinting at memory corruption.
When compiling with "-fsanitize=address", a "heap-use-after-free" is detected.
Your environment
- version of mlpack: 3.2.2 (Present since at least 3.1.x)
- operating system: Gentoo Linux, Vanilla kernel 5.5.9
- compiler: gcc 9.3.0 (also earlier 9.x tested),
- version of dependencies (Boost/Armadillo): boost 1.72, 1.71, and 1.65; armadillo 9.850 and 9.600.5; ensmallen 2.11.3, 1.15.1
- any other environment information you think is relevant:
Steps to reproduce
Based on the tutorial, it is sufficient to insert a line FFN<> model2 = model after model.Train(…).
See modified tutorial source in the attached zip file.
The output is provided in output.txt.
Expected behavior
The program should run happily ever after.
Actual behavior
In this simple example, the address sanitizer detects the source of the memory corruption.
In a larger application, signs of memory corruption occur, i.e., sporadic errors in all parts of the program. In a program with Qt user interface, errors were happening mostly in those parts which require the most dynamic memory, i.e., string handling and painting.
These problems can be mitigated by trying to not copy any FFN. Unfortunately, this beats parts of the applications purpose. And some very difficult to hit issues might still remain.
==16542==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b000000e80 at pc 0x7fb2f4b19f50 bp 0x7ffc6ed262a0 sp 0x7ffc6ed25a48