AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete)

[xyzz]

#include <msgpack.hpp>
#include <iostream>
#include <string>

int main(void) {
        // serializes multiple objects using msgpack::packer.
        msgpack::sbuffer buffer;

        msgpack::packer<msgpack::sbuffer> pk(&buffer);
        pk.pack(std::string("Log message ... 1"));
        pk.pack(std::string("Log message ... 2"));
        pk.pack(std::string("Log message ... 3"));

        // deserializes these objects using msgpack::unpacker.
        msgpack::unpacker pac;

        // feeds the buffer.
        pac.reserve_buffer(buffer.size());
        memcpy(pac.buffer(), buffer.data(), buffer.size());
        pac.buffer_consumed(buffer.size());

        // now starts streaming deserialization.
        msgpack::unpacked result;
        while(pac.next(&result)) {
            std::cout << result.get() << std::endl;
        }

        // results:
        // $ g++ stream.cc -lmsgpack -o stream
        // $ ./stream
        // "Log message ... 1"
        // "Log message ... 2"
        // "Log message ... 3"
}

Running this sample program under ASan produces the following:

"Log message ... 1"
=================================================================
==1007==ERROR: AddressSanitizer: alloc-dealloc-mismatch (malloc vs operator delete) on 0x625000007900
    #0 0x423114 in operator delete(void*) ??:?
    #1 0x43818e in std::auto_ptr<msgpack::zone>::reset(msgpack::zone*) /usr/lib/gcc/x86_64-pc-linux-gnu/4.8.2/include/g++-v4/backward/auto_ptr.h:244
    #2 0x4340ac in msgpack::unpacker::next(msgpack::unpacked*) /usr/include/msgpack/unpack.hpp:234
    #3 0x4313e4 in main /tmp/msgpack-wat/code3.cpp:24
    #4 0x7f36399afbf4 in ?? ??:0
0x625000007900 is located 0 bytes inside of 8248-byte region [0x625000007900,0x625000009938)
allocated by thread T0 here:
    #0 0x422b74 in malloc ??:?
    #1 0x43cdd1 in msgpack_zone_new /home/xyz/msgpack-c/src/zone.c:198
==1007==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==1007==ABORTING

[redboltz]

Thank you for your report. I analyze the problem.
The zone memory is allocated the following point:
https://github.com/msgpack/msgpack-c/blob/master/src/unpack.c#L207

It calls malloc.
https://github.com/msgpack/msgpack-c/blob/master/src/zone.c#L198

In the unpacking proccess, auto_ptr is set at here:
https://github.com/msgpack/msgpack-c/blob/master/src/msgpack/unpack.hpp#L234
Finally, the auto_ptr will call the operator delete.

In the function unpacker::release_zone,
https://github.com/msgpack/msgpack-c/blob/master/src/msgpack/unpack.hpp#L259
The function convertes from msgpack_zone* that is allocated by malloc to msgpack::zone*.

msgpack::zone inherits msgpack_zone as follos:
https://github.com/msgpack/msgpack-c/blob/master/src/msgpack/zone.hpp.erb#L30
msgpack::zone doesn't have any data members.
So, static downcast itself is not a problem. But msgpack::zone* is held by auto_ptr finally, that is a problem.

In C++11, we can use std::unique_ptr with deleter that calls msgpack_zone_free instead of operator delete.
https://github.com/msgpack/msgpack-c/blob/master/src/zone.c#L216

In C++03, there is no standard mechanism to do that. I think that we need to use some boost smart pointers or implement the original zone handler that calls msgpack_zone_free in their destructor.