Ubuntu
gnuplot package

gnuplot crashes when binary format ignores all data

Bug #369671 reported by Andrey M on 2009-04-30

This bug affects 2 people

Affects		Status	Importance	Assigned to	Milestone
	gnuplot	Unknown	Unknown	sf #3002679
	gnuplot (Ubuntu)	Confirmed	Undecided	Unassigned

Bug Description

Binary package hint: gnuplot

andrey@freshmeat:~/tmp$ Description: Ubuntu 8.10
Release: 8.10
andrey@freshmeat:~/tmp$ gnuplot:
  Installed: 4.2.3-1
  Candidate: 4.2.3-1
  Version table:
*** 4.2.3-1 0
        500         100 andrey@freshmeat:~/tmp$ gnuplot> plot 'tst.dat' *** buffer overflow detected ***: gnuplot ======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.i686/cmov/libc.so.i686/cmov/libc.so. gnuplot[0x80a8620]
gnuplot[0x806230f]
gnuplot[0x806297d]
gnuplot[0x80a4255]
/lib/tls/i686/cmov/libc.so. ======= Memory map: ========
08048000-08168000 r-xp 00000000 08:01 1229602 08168000-08169000 r--p 0011f000 08:01 1229602 08169000-0817a000 rw-p 00120000 08:01 1229602 0817a000-08185000 rw-p 0817a000 00:00 0
09f0d000-0a0ff000 rw-p 09f0d000 00:00 0 b6031000-b623e000 rw-p b6031000 00:00 0
b623e000-b62d3000 r--p 00000000 08:01 270337 b62d3000-b6333000 rw-s 00000000 00:09 3866644 b6333000-b6334000 ---p b6333000 00:00 0
b6334000-b6b34000 rw-p b6334000 00:00 0
b6b34000-b6b94000 rw-s 00000000 00:09 3833875 b6b94000-b6b9a000 r-xp 00000000 08:01 1232213 b6b9a000-b6b9b000 r--p 00005000 08:01 1232213 b6b9b000-b6b9c000 rw-p 00006000 08:01 1232213 b6b9c000-b6bcb000 r-xp 00000000 08:01 1230649 b6bcb000-b6bcc000 r--p 0002e000 08:01 1230649 b6bcc000-b6bcd000 rw-p 0002f000 08:01 1230649 b6bcd000-b6c0b000 r-xp 00000000 08:01 499875 b6c0b000-b6c0c000 r--p 0003d000 08:01 499875 b6c0c000-b6c0d000 rw-p 0003e000 08:01 499875 b6c0d000-b6d42000 r-xp 00000000 08:01 1229934 b6d42000-b6d43000 ---p 00135000 08:01 1229934 b6d43000-b6d47000 r--p 00135000 08:01 1229934 b6d47000-b6d48000 rw-p 00139000 08:01 1229934 b6d48000-b6d49000 rw-p b6d48000 00:00 0
b6d49000-b6d5e000 r-xp 00000000 08:01 1231100 b6d5e000-b6d60000 rw-p 00014000 08:01 1231100 b6d60000-b6dc6000 r-xp 00000000 08:01 499867 b6dc6000-b6dc7000 ---p 00066000 08:01 499867 b6dc7000-b6dc8000 r--p 00066000 08:01 499867 b6dc8000-b6dc9000 rw-p 00067000 08:01 499867 b6dcb000-b6dcd000 r-xp 00000000 08:01 1411308 b6dcd000-b6dce000 r--p 00001000 08:01 1411308 b6dce000-b6dcf000 rw-p 00002000 08:01 1411308 b6dcf000-b6dd2000 rw-s 00000000 00:09 3899413 b6dd2000-b6dd8000 r-xp 00000000 08:01 1253909 b6dd8000-b6dd9000 r--p 00005000 08:01 1253909 b6dd9000-b6dda000 rw-p 00006000 08:01 1253909 b6dda000-b6de0000 r--s 00000000 08:01 2238113 b6de0000-b6de3000 r--s 00000000 08:01 2238007 b6de3000-b6de5000 r--s 00000000 08:01 2238067 b6de5000-b6de8000 r--s 00000000 08:01 2238015 b6de8000-b6de9000 r--s 00000000 08:01 2237964 b6de9000-b6dec000 r--s 00000000 08:01 2238139 lsb_release -rd
apt-cache policy gnuplot
http://us.archive.ubuntu.com intrepid/universe Packages
/var/lib/dpkg/status
g++ tstdat.cpp; ./a.out; gnuplot
binary format='%*double%*double" using 1:2
terminated
/>6(__fortify_fail+0x48)[0xb792a6d8]
/>6[0xb7928800]
/>6(__fread_chk+0x143)[0xb79290f3]
/>6(__libc_start_main+0xe5)[0xb7846685]
/usr/bin/gnuplot
/usr/bin/gnuplot
/usr/bin/gnuplot
[heap]
/usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
/SYSV00000000 (deleted)
/SYSV00000000 (deleted)
/usr/lib/libgailutil.so.18.0.1
/usr/lib/libgailutil.so.18.0.1
/usr/lib/libgailutil.so.18.0.1
/usr/lib/libgnomecanvas-2.so.0.2001.0
/usr/lib/libgnomecanvas-2.so.0.2001.0
/usr/lib/libgnomecanvas-2.so.0.2001.0
/usr/lib/libgnomeprintui-2-2.so.0.1.0
/usr/lib/libgnomeprintui-2-2.so.0.1.0
/usr/lib/libgnomeprintui-2-2.so.0.1.0
/usr/lib/libxml2.so.2.6.32
/usr/lib/libxml2.so.2.6.32
/usr/lib/libxml2.so.2.6.32
/usr/lib/libxml2.so.2.6.32
/usr/lib/libart_lgpl_2.so.2.3.20
/usr/lib/libart_lgpl_2.so.2.3.20
/usr/lib/libgnomeprint-2-2.so.0.1.0
/usr/lib/libgnomeprint-2-2.so.0.1.0
/usr/lib/libgnomeprint-2-2.so.0.1.0
/usr/lib/libgnomeprint-2-2.so.0.1.0
/usr/lib/pango/1.6.0/modules/pango-basic-fc.so
/usr/lib/pango/1.6.0/modules/pango-basic-fc.so
/usr/lib/pango/1.6.0/modules/pango-basic-fc.so
/SYSV00000000 (deleted)
/usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
/usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
/usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
/var/cache/fontconfig/945677eb7aeaf62f1d50efc3fb3ec7d8-x86.cache-2
/var/cache/fontconfig/e383d7ea5fbe662a33d9b44caf393297-x86.cache-2
/var/cache/fontconfig/c69f04ab05004e31a6d5e715764f16d8-x86.cache-2
/var/cache/fontconfig/6eb3985aa4124903f6ff08ba781cd364-x86.cache-2
/var/cache/fontconfig/4c73fe0c47614734b17d736dbde7580a-x86.cache-2
/var/cacAborted

See original description

Revision history for this message

Andrey M (andrey.mrt.) wrote on 2009-04-30:

C program that generates input datafile for gnuplot Edit (232 bytes, text/x-c++src)

Andrey M (andrey.mrt.) on 2009-05-05

description:

updated

Revision history for this message

Alex Valavanis (valavanisalex) wrote on 2010-05-17:

An asterisk in the format string tells gnuplot to ignore a variable. In other words, you're telling it to ignore the entire contents of the datafile and then to plot it. Everything is fine if you use the command:

plot 'tst.dat' binary format '%double' using 1:2

Therefore, the problem occurs when the format string states that all data must be ignored.

Changed in gnuplot (Ubuntu):
status:	New → Invalid

Alex Valavanis (valavanisalex) on 2010-05-17

Changed in gnuplot (Ubuntu):
status:	Invalid → Confirmed
summary:	- gnuplot crashes on binary format + gnuplot crashes when binary format ignores all data

Revision history for this message

Alex Valavanis (valavanisalex) wrote on 2010-05-17:

Here's a more complete backtrace for the bug

Revision history for this message

Andrey M (andrey.mrt.) wrote on 2010-05-17:

The attached file "gdb-chromium-browser.txt" seems irrelevant to this bug.
It is merely a debug dump of chrome, not gnuplot.

Revision history for this message

Alex Valavanis (valavanisalex) wrote on 2010-05-17:

gdb-gnuplot.txt Edit (8.4 KiB, text/plain)

Oops! Sorry about that. I have now uploaded the correct backtrace file!

Revision history for this message

Ethan Merritt (sfeam) wrote on 2010-05-17:

I can't reproduce this problem using either the [really old] version 4.2.3 or current 4.4.0
Gnuplot reports an error message about empty data ranges, but recovers gracefully.
Admittedly I'm not running Ubuntu. I tested both 32-bit and 64-bit Mandriva.

Can you get a useful trace of the failure from inside gdb (with line numbers, etc)
or from valgrind?

[19] make tstdat ; ./tstdat ; gnuplot_4.2.3

        G N U P L O T
        Version 4.2 patchlevel 3
        last modified Mar 2008
        System: Linux 2.6.31.12-desktop-3mnb

Type `help` to access the on-line reference manual.
The gnuplot FAQ is available from http://www.gnuplot.info/faq/

Send bug reports and suggestions to <http://sourceforge.net/projects/gnuplot>

Terminal type set to 'wxt'
gnuplot> plot 'tst.dat' binary format='%*double%*double" using 1:2
Warning: empty x range [0:0], adjusting to [-1:1]

sfeam (gnuplot developer)

Revision history for this message

Alex Valavanis (valavanisalex) wrote on 2010-05-17:

valgrind.log Edit (28.1 KiB, text/plain)

Hi Ethan,

The gdb backtrace I uploaded appears to have line numbers in it. If there's something I did wrong when obtaining the backtrace, please let me know.

I tried running valgrind too. Logfile attached...

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

sf #3002679
[:] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntugnuplot package

gnuplot crashes when binary format ignores all data

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
gnuplot package