Archived issue #0030207
ChFi3d_KParticular stack-use-after-scope
Description
Running OCC with the llvm sanitizer I get the following error:
=================================================================
==601==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd16140748 at pc 0x7f51f34051b4 bp 0x7ffd161405f0 sp 0x7ffd161405e8
READ of size 8 at 0x7ffd16140748 thread T0
#0 0x7f51f34051b3 in gp_XYZ::Dot(gp_XYZ const&) const opencascade-7.3/src/gp/gp_XYZ.lxx:160
#0000001 0x7f51f34051b3 in gp_Dir::Angle(gp_Dir const&) const opencascade-7.3/src/gp/gp_Dir.cxx:36
#0000002 0x7f51eef658b3 in gp_Dir::IsParallel(gp_Dir const&, double) const opencascade-7.3/src/gp/gp_Dir.lxx:175
#3 0x7f51eef658b3 in ChFi3d_KParticular(opencascade::handle<ChFiDS_Spine> const&, int, BRepAdaptor_Surface const&, BRepAdaptor_Surface const&) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_0.cxx:547
#4 0x7f51eefd9c32 in ChFi3d_Builder::PerformSetOfKPart(opencascade::handle<ChFiDS_Stripe>&, bool) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_2.cxx:2342
#5 0x7f51ef0002fd in ChFi3d_Builder::PerformSetOfSurf(opencascade::handle<ChFiDS_Stripe>&, bool) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_2.cxx:2968
#6 0x7f51eef55eef in ChFi3d_Builder::Compute() opencascade-7.3/src/ChFi3d/ChFi3d_Builder.cxx:264
#0000007 0x7f51ef4732ec in BRepFilletAPI_MakeChamfer::Build() opencascade-7.3/src/BRepFilletAPI/BRepFilletAPI_MakeChamfer.cxx:389
The problem is on line 547 of ChFi3d_Builder_0.cxx:
const gp_Dir& aD1=aS1.Plane().Axis().Direction();
Here, aS1.Plane(), which is,
gp_Pln BRepAdaptor_Surface::Plane()const
{
return mySurf.Plane().Transformed(myTrsf);
}
returns a temporary object of the type gp_Pln. As a result const gp_Dir& aD1 references a temporary object. The functions calls to aS2.Cylinder() and aS2.Cone() have the same problem in ChFi3d_KParticular.
The following patch resolves the issue:
Index: src/ChFi3d/ChFi3d_Builder_0.cxx
===================================================================
--- src/ChFi3d/ChFi3d_Builder_0.cxx (revision 1)
+++ src/ChFi3d/ChFi3d_Builder_0.cxx (working copy)
@@ -538,8 +538,8 @@
}
}
else if (aST2==GeomAbs_Cylinder) {
- const gp_Dir& aD1=aS1.Plane().Axis().Direction();
- const gp_Dir& aD2=aS2.Cylinder().Axis().Direction();
+ const gp_Dir aD1=aS1.Plane().Axis().Direction();
+ const gp_Dir aD2=aS2.Cylinder().Axis().Direction();
//
if (aCT==GeomAbs_Line && aD1.IsNormal(aD2, aPA)) {
return bRet;
@@ -549,8 +549,8 @@
}
}
else if(aST2==GeomAbs_Cone) {
- const gp_Dir& aD1=aS1.Plane().Axis().Direction();
- const gp_Dir& aD2=aS2.Cone().Axis().Direction();
+ const gp_Dir aD1=aS1.Plane().Axis().Direction();
+ const gp_Dir aD2=aS2.Cone().Axis().Direction();
if (aCT == GeomAbs_Circle && aD1.IsParallel(aD2, aPA)) {
return bRet;
}
=================================================================
==601==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffd16140748 at pc 0x7f51f34051b4 bp 0x7ffd161405f0 sp 0x7ffd161405e8
READ of size 8 at 0x7ffd16140748 thread T0
#0 0x7f51f34051b3 in gp_XYZ::Dot(gp_XYZ const&) const opencascade-7.3/src/gp/gp_XYZ.lxx:160
#0000001 0x7f51f34051b3 in gp_Dir::Angle(gp_Dir const&) const opencascade-7.3/src/gp/gp_Dir.cxx:36
#0000002 0x7f51eef658b3 in gp_Dir::IsParallel(gp_Dir const&, double) const opencascade-7.3/src/gp/gp_Dir.lxx:175
#3 0x7f51eef658b3 in ChFi3d_KParticular(opencascade::handle<ChFiDS_Spine> const&, int, BRepAdaptor_Surface const&, BRepAdaptor_Surface const&) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_0.cxx:547
#4 0x7f51eefd9c32 in ChFi3d_Builder::PerformSetOfKPart(opencascade::handle<ChFiDS_Stripe>&, bool) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_2.cxx:2342
#5 0x7f51ef0002fd in ChFi3d_Builder::PerformSetOfSurf(opencascade::handle<ChFiDS_Stripe>&, bool) opencascade-7.3/src/ChFi3d/ChFi3d_Builder_2.cxx:2968
#6 0x7f51eef55eef in ChFi3d_Builder::Compute() opencascade-7.3/src/ChFi3d/ChFi3d_Builder.cxx:264
#0000007 0x7f51ef4732ec in BRepFilletAPI_MakeChamfer::Build() opencascade-7.3/src/BRepFilletAPI/BRepFilletAPI_MakeChamfer.cxx:389
The problem is on line 547 of ChFi3d_Builder_0.cxx:
const gp_Dir& aD1=aS1.Plane().Axis().Direction();
Here, aS1.Plane(), which is,
gp_Pln BRepAdaptor_Surface::Plane()const
{
return mySurf.Plane().Transformed(myTrsf);
}
returns a temporary object of the type gp_Pln. As a result const gp_Dir& aD1 references a temporary object. The functions calls to aS2.Cylinder() and aS2.Cone() have the same problem in ChFi3d_KParticular.
The following patch resolves the issue:
Index: src/ChFi3d/ChFi3d_Builder_0.cxx
===================================================================
--- src/ChFi3d/ChFi3d_Builder_0.cxx (revision 1)
+++ src/ChFi3d/ChFi3d_Builder_0.cxx (working copy)
@@ -538,8 +538,8 @@
}
}
else if (aST2==GeomAbs_Cylinder) {
- const gp_Dir& aD1=aS1.Plane().Axis().Direction();
- const gp_Dir& aD2=aS2.Cylinder().Axis().Direction();
+ const gp_Dir aD1=aS1.Plane().Axis().Direction();
+ const gp_Dir aD2=aS2.Cylinder().Axis().Direction();
//
if (aCT==GeomAbs_Line && aD1.IsNormal(aD2, aPA)) {
return bRet;
@@ -549,8 +549,8 @@
}
}
else if(aST2==GeomAbs_Cone) {
- const gp_Dir& aD1=aS1.Plane().Axis().Direction();
- const gp_Dir& aD2=aS2.Cone().Axis().Direction();
+ const gp_Dir aD1=aS1.Plane().Axis().Direction();
+ const gp_Dir aD2=aS2.Cone().Axis().Direction();
if (aCT == GeomAbs_Circle && aD1.IsParallel(aD2, aPA)) {
return bRet;
}
Steps to reproduce
Compile OCCT 7.3 using gcc 4.9 or newer, or the clang compiler, with the flags "-g -fsanitize=address -fno-omit-frame-pointer". If you have a link error you might need to add -fuse-ld=gold. Then run any test cases that call BRepFilletAPI_MakeChamfer. I can generate some .brep files if needed.
New test case is not needed. However, the following script calls the described fragment.
### SCRIPT ###
pload ALL
pcylinder cy 100 500
explode cy f
explode cy_1 e
chamf cf cy cy_1_3 cy_1 S 10
New test case is not needed. However, the following script calls the described fragment.
### SCRIPT ###
pload ALL
pcylinder cy 100 500
explode cy f
explode cy_1 e
chamf cf cy cy_1_3 cy_1 S 10
Public activity
5 archived notes
Participants are labeled by their role within this record.
Branch [archived branch] has been created by Participant.
[revision removed]
Detailed log of new commits:
Author: nbv
Date: Mon Oct 8 12:12:07 2018 +0300
0030207: ChFi3d_KParticular stack-use-after-scope
References to temporary objects have been eliminated.
[revision removed]
Detailed log of new commits:
Author: nbv
Date: Mon Oct 8 12:12:07 2018 +0300
0030207: ChFi3d_KParticular stack-use-after-scope
References to temporary objects have been eliminated.
Dear Mikhail,
Please review the current state of the branch CR30207.
Test results are here: http://jenkins-test-12.nnov.opencascade.com/view/CR30207-master_NBV/.
Please review the current state of the branch CR30207.
Test results are here: http://jenkins-test-12.nnov.opencascade.com/view/CR30207-master_NBV/.
Reviewed.
Combination -
OCCT branch : [archived branch] SHA - [revision removed]
Products branch : [archived branch] SHA - [revision removed]
was compiled on Linux, MacOS and Windows platforms and tested in optimize mode.
Number of compiler warnings:
No new/fixed warnings
Regressions/Differences/Improvements:
No regressions/differences
CPU differences:
Debian80-64:
OCCT
Total CPU difference: 17369.85999999986 / 17385.999999999854 [-0.09%]
Products
Total CPU difference: 7433.980000000049 / 7445.680000000064 [-0.16%]
Windows-64-VC14:
OCCT
Total CPU difference: 17425.70170249843 / 17457.853508598404 [-0.18%]
Products
Total CPU difference: 8367.659638499994 / 8343.292282299992 [+0.29%]
Image differences :
No differences that require special attention
Memory differences :
No differences that require special attention
OCCT branch : [archived branch] SHA - [revision removed]
Products branch : [archived branch] SHA - [revision removed]
was compiled on Linux, MacOS and Windows platforms and tested in optimize mode.
Number of compiler warnings:
No new/fixed warnings
Regressions/Differences/Improvements:
No regressions/differences
CPU differences:
Debian80-64:
OCCT
Total CPU difference: 17369.85999999986 / 17385.999999999854 [-0.09%]
Products
Total CPU difference: 7433.980000000049 / 7445.680000000064 [-0.16%]
Windows-64-VC14:
OCCT
Total CPU difference: 17425.70170249843 / 17457.853508598404 [-0.18%]
Products
Total CPU difference: 8367.659638499994 / 8343.292282299992 [+0.29%]
Image differences :
No differences that require special attention
Memory differences :
No differences that require special attention
Branch [archived branch] has been deleted by Participant.
[revision removed]
[revision removed]
Related records