Skip to content

Copying a FFN leads to silently corrupted memory (address sanitizer detects a heap use after free) #2314

@janbraun

Description

@janbraun

Issue description

Unfortunately, when copying a mlpack::ann::FFN, the program seems to continue operating normally, but in a program with longer runtime and dynamic memory usage, bizarre effects can surface hinting at memory corruption.

When compiling with "-fsanitize=address", a "heap-use-after-free" is detected.

Your environment

  • version of mlpack: 3.2.2 (Present since at least 3.1.x)
  • operating system: Gentoo Linux, Vanilla kernel 5.5.9
  • compiler: gcc 9.3.0 (also earlier 9.x tested),
  • version of dependencies (Boost/Armadillo): boost 1.72, 1.71, and 1.65; armadillo 9.850 and 9.600.5; ensmallen 2.11.3, 1.15.1
  • any other environment information you think is relevant:

Steps to reproduce

Based on the tutorial, it is sufficient to insert a line FFN<> model2 = model after model.Train(…).
See modified tutorial source in the attached zip file.
The output is provided in output.txt.

Expected behavior

The program should run happily ever after.

Actual behavior

In this simple example, the address sanitizer detects the source of the memory corruption.

In a larger application, signs of memory corruption occur, i.e., sporadic errors in all parts of the program. In a program with Qt user interface, errors were happening mostly in those parts which require the most dynamic memory, i.e., string handling and painting.
These problems can be mitigated by trying to not copy any FFN. Unfortunately, this beats parts of the applications purpose. And some very difficult to hit issues might still remain.

==16542==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b000000e80 at pc 0x7fb2f4b19f50 bp 0x7ffc6ed262a0 sp 0x7ffc6ed25a48

output.txt
ffn_copy_bug.zip

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions