Skip to content

Commit

Permalink
[tree] Avoid heap-use-after-free in BulkApiVarLength test
Browse files Browse the repository at this point in the history
Ensure proper TFile memory management and avoid TTreeReader accessing the TFile after its destruction.

```
479: ==2573107==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000051b48 at pc 0x7f0fcf4e089e bp 0x7fff6e7e1fe0 sp 0x7fff6e7e1fd8
479: READ of size 8 at 0x617000051b48 thread T0
479:     #0 0x7f0fcf4e089d in TTree::GetNotify() const /home/vpadulan/Programs/rootproject/rootsrc/tree/tree/inc/TTree.h:503
479:     #1 0x7f0fcf4e089d in void TNotifyLinkBase::RemoveLink<TTree>(TTree&) /home/vpadulan/Programs/rootproject/rootsrc/core/base/inc/TNotifyLin
k.h:104
479:     #2 0x7f0fcf4e089d in TTreeReader::~TTreeReader() /home/vpadulan/Programs/rootproject/rootsrc/tree/treeplayer/src/TTreeReader.cxx:252
479:     #3 0x4321ca in BulkApiVariableTest_stdRead_Test::TestBody() /home/vpadulan/Programs/rootproject/rootsrc/tree/tree/test/BulkApiVarLength.c
xx:135
479:     root-project#4 0x470c8c in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)()
, char const*) (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-asan/tree/tree/test/testBulkApiVarLength+0x470
c8c) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#5 0x45a6d3 in testing::Test::Run() [clone .part.0] (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-
asan/tree/tree/test/testBulkApiVarLength+0x45a6d3) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#6 0x45aa49 in testing::TestInfo::Run() (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-asan/tree/tr
ee/test/testBulkApiVarLength+0x45aa49) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#7 0x45abf0 in testing::TestSuite::Run() [clone .part.0] (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-tes
ting-asan/tree/tree/test/testBulkApiVarLength+0x45abf0) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#8 0x46769e in testing::internal::UnitTestImpl::RunAllTests() (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-fre
e-testing-asan/tree/tree/test/testBulkApiVarLength+0x46769e) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#9 0x45b04c in testing::UnitTest::Run() (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-asan/tree/tr
ee/test/testBulkApiVarLength+0x45b04c) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479:     root-project#10 0x424606 in main (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-asan/tree/tree/test/testBulkApi
VarLength+0x424606) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
479: 0x617000051b48 is located 328 bytes inside of 712-byte region [0x617000051a00,0x617000051cc8)

479: freed by thread T0 here:
479:     #0 0x7f0fcf8da878 in operator delete(void*) (/lib64/libasan.so.8+0xda878) (BuildId: 2e1c50524ff1a2e7e73c4565b46f3f51892353ea)
479:     #1 0x7f0fcb9b4f25 in TCollection::GarbageCollect(TObject*) /home/vpadulan/Programs/rootproject/rootsrc/core/cont/src/TCollection.cxx:736
479:     #2 0x7f0fcb9e8a27 in TList::Delete(char const*) /home/vpadulan/Programs/rootproject/rootsrc/core/cont/src/TList.cxx:535
479:     #3 0x7f0fcb9c53d7 in THashList::Delete(char const*) /home/vpadulan/Programs/rootproject/rootsrc/core/cont/src/THashList.cxx:215
479:     root-project#4 0x7f0fcc2d285d in TDirectoryFile::Close(char const*) /home/vpadulan/Programs/rootproject/rootsrc/io/io/src/TDirectoryFile.cxx:585
479:     root-project#5 0x7f0fcc2d285d in TDirectoryFile::Close(char const*) /home/vpadulan/Programs/rootproject/rootsrc/io/io/src/TDirectoryFile.cxx:561
479:     root-project#6 0x7f0fcc3468e4 in TFile::Close(char const*) /home/vpadulan/Programs/rootproject/rootsrc/io/io/src/TFile.cxx:989
479:     root-project#7 0x7f0fcc3481fd in TFile::~TFile() /home/vpadulan/Programs/rootproject/rootsrc/io/io/src/TFile.cxx:566
479:     root-project#8 0x7f0fcc348fd0 in TFile::~TFile() /home/vpadulan/Programs/rootproject/rootsrc/io/io/src/TFile.cxx:603
479:     root-project#9 0x432ebf in BulkApiVariableTest_stdRead_Test::TestBody() /home/vpadulan/Programs/rootproject/rootsrc/tree/tree/test/BulkApiVarLength.c
xx:130
479:     root-project#10 0x470c8c in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(
), char const*) (/home/vpadulan/Programs/rootproject/rootbuild/bulksilly-heap-use-after-free-testing-asan/tree/tree/test/testBulkApiVarLength+0x47
0c8c) (BuildId: aac947b72f02e5567382f0dadfefd1e97d058a56)
```
  • Loading branch information
vepadulano committed Jun 12, 2024
1 parent bc1e20c commit b8d8109
Showing 1 changed file with 4 additions and 5 deletions.
9 changes: 4 additions & 5 deletions tree/tree/test/BulkApiVarLength.cxx
Original file line number Diff line number Diff line change
Expand Up @@ -72,13 +72,13 @@ constexpr Long64_t BulkApiVariableTest::fEventCount;

TEST_F(BulkApiVariableTest, stdRead)
{
auto hfile = TFile::Open(fFileName.c_str());
std::unique_ptr<TFile> hfile{TFile::Open(fFileName.c_str())};
printf("Starting read of file %s.\n", fFileName.c_str());
TStopwatch sw;

printf("Using standard read APIs.\n");

TTreeReader myReader("T", hfile);
TTreeReader myReader("T", hfile.get());
TTreeReaderArray<float> myF(myReader, "f");
TTreeReaderArray<double> myD(myReader, "d");
TTreeReaderValue<int> myI(myReader, "myLen");
Expand Down Expand Up @@ -126,8 +126,7 @@ TEST_F(BulkApiVariableTest, stdRead)
}
ev++;
}
ASSERT_EQ(ev, events+1);
delete hfile;
ASSERT_EQ(ev, events + 1);

sw.Stop();
printf("TTreeReader: Successful read of all events.\n");
Expand All @@ -136,7 +135,7 @@ TEST_F(BulkApiVariableTest, stdRead)

TEST_F(BulkApiVariableTest, serializedRead)
{
auto hfile = TFile::Open(fFileName.c_str());
std::unique_ptr<TFile> hfile{TFile::Open(fFileName.c_str())};
printf("Starting read of file %s.\n", fFileName.c_str());
TStopwatch sw;

Expand Down

0 comments on commit b8d8109

Please sign in to comment.